Issued:
2010-04-14
Updated:
2010-04-14

RHSA-2010:0348 - Security Advisory

Synopsis

Important: kdebase security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated kdebase packages that fix one security issue are now available for
Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

The K Desktop Environment (KDE) is a graphical desktop environment for the
X Window System. The kdebase packages include core applications for KDE.

A privilege escalation flaw was found in the KDE Display Manager (KDM). A
local user with console access could trigger a race condition, possibly
resulting in the permissions of an arbitrary file being set to world
writable, allowing privilege escalation. (CVE-2010-0436)

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for
responsibly reporting this issue.

Users of KDE should upgrade to these updated packages, which contain a
backported patch to correct this issue. The system should be rebooted for
this update to take effect. After the reboot, administrators should
manually remove all leftover user-owned dmctl-* directories in
"/var/run/xdmctl/".

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 ia64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 570613 - CVE-2010-0436 kdm privilege escalation flaw

Red Hat Enterprise Linux Server 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
x86_64
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: ebd9defa647c75066d176b436c4cef506aaff799cd1b1b3556a9558f15d507f3
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55
kdebase-devel-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: e038170d6672e83b6683c7e91f3e9bfb1a3befe4b719bd20a2d6f40c03cef389
ia64
kdebase-3.5.4-21.el5_5.1.ia64.rpm SHA-256: 9b455345a86f8d136378ef870e0741fc74599228f573eb98e8cdb51e0d5f3972
kdebase-devel-3.5.4-21.el5_5.1.ia64.rpm SHA-256: 5841a011b200858a6eea56cc4f3874b58284581dc7f91bf6075ad535a84d4636
i386
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55

Red Hat Enterprise Linux Server 4

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
x86_64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
ia64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.ia64.rpm SHA-256: afe7fcf08f131ace41aa3b1ca9c508b5cd9d4c0cad98e41a3ecb898505fbc68d
kdebase-3.3.1-13.el4_8.1.ia64.rpm SHA-256: afe7fcf08f131ace41aa3b1ca9c508b5cd9d4c0cad98e41a3ecb898505fbc68d
kdebase-devel-3.3.1-13.el4_8.1.ia64.rpm SHA-256: e72e20b1e295e6ce0d129cd29c355e648111d78d534a988b90c90fa26e82a7d7
kdebase-devel-3.3.1-13.el4_8.1.ia64.rpm SHA-256: e72e20b1e295e6ce0d129cd29c355e648111d78d534a988b90c90fa26e82a7d7
i386
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8

Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
x86_64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
ia64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.ia64.rpm SHA-256: afe7fcf08f131ace41aa3b1ca9c508b5cd9d4c0cad98e41a3ecb898505fbc68d
kdebase-3.3.1-13.el4_8.1.ia64.rpm SHA-256: afe7fcf08f131ace41aa3b1ca9c508b5cd9d4c0cad98e41a3ecb898505fbc68d
kdebase-devel-3.3.1-13.el4_8.1.ia64.rpm SHA-256: e72e20b1e295e6ce0d129cd29c355e648111d78d534a988b90c90fa26e82a7d7
kdebase-devel-3.3.1-13.el4_8.1.ia64.rpm SHA-256: e72e20b1e295e6ce0d129cd29c355e648111d78d534a988b90c90fa26e82a7d7
i386
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8

Red Hat Enterprise Linux Workstation 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
x86_64
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: ebd9defa647c75066d176b436c4cef506aaff799cd1b1b3556a9558f15d507f3
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55
kdebase-devel-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: e038170d6672e83b6683c7e91f3e9bfb1a3befe4b719bd20a2d6f40c03cef389
i386
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55

Red Hat Enterprise Linux Workstation 4

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
x86_64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
ia64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.ia64.rpm SHA-256: afe7fcf08f131ace41aa3b1ca9c508b5cd9d4c0cad98e41a3ecb898505fbc68d
kdebase-devel-3.3.1-13.el4_8.1.ia64.rpm SHA-256: e72e20b1e295e6ce0d129cd29c355e648111d78d534a988b90c90fa26e82a7d7
i386
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8

Red Hat Enterprise Linux Desktop 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
x86_64
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: ebd9defa647c75066d176b436c4cef506aaff799cd1b1b3556a9558f15d507f3
i386
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002

Red Hat Enterprise Linux Desktop 4

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
x86_64
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: ca0f0652626037ce32745d21547ebd4015eb4c2ecf753172d743b80695582416
kdebase-devel-3.3.1-13.el4_8.1.x86_64.rpm SHA-256: 8caef8019b08e61ec899de8f7024db48bc696c664c7466d97bd084bf246ff7cf
i386
kdebase-3.3.1-13.el4_8.1.i386.rpm SHA-256: 218b73a59b74492c701ba23dcd78ec79c083f30a182e29c5299585db2ef0f69d
kdebase-devel-3.3.1-13.el4_8.1.i386.rpm SHA-256: df774d92a64760220d937db6c2c2f438ba1f273cf216e7e3e8372c5b8898e1d8

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
s390x
kdebase-3.5.4-21.el5_5.1.s390.rpm SHA-256: 546070d336300b30efc108378a5652594e53a8088ba6ab36d050668ba339a3f4
kdebase-3.5.4-21.el5_5.1.s390x.rpm SHA-256: 8451002ad741352067f9224900d25943621ada6889639716cd2080f856c2d16f
kdebase-devel-3.5.4-21.el5_5.1.s390.rpm SHA-256: 686ce0cbab689c4e02df695fba53419a404d57945409c230613aaee3f8bed9f6
kdebase-devel-3.5.4-21.el5_5.1.s390x.rpm SHA-256: 5d83ae8a6fa6aca316dbccfc82817527a190e577cdc1ccaf7c5e009ccc38866d

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
s390x
kdebase-3.3.1-13.el4_8.1.s390.rpm SHA-256: 37db7afc62420e24927e93a49a30efbf3d811bfda19cf29d45d710002419dd58
kdebase-3.3.1-13.el4_8.1.s390x.rpm SHA-256: 946fd28557932cd885887387199707c0c59250e3a670bcbb1005470627dbaf24
kdebase-devel-3.3.1-13.el4_8.1.s390x.rpm SHA-256: e62a5241e34e156ee52cd91e3badc97fc2613b6064a61ccc7619b20e541aaceb
s390
kdebase-3.3.1-13.el4_8.1.s390.rpm SHA-256: 37db7afc62420e24927e93a49a30efbf3d811bfda19cf29d45d710002419dd58
kdebase-devel-3.3.1-13.el4_8.1.s390.rpm SHA-256: 63edd650d42da1f499e33f7dc4ec62c1cf4bd6df76edf3028f86febd87450c0a

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
s390x
kdebase-3.3.1-13.el4_8.1.s390.rpm SHA-256: 37db7afc62420e24927e93a49a30efbf3d811bfda19cf29d45d710002419dd58
kdebase-3.3.1-13.el4_8.1.s390x.rpm SHA-256: 946fd28557932cd885887387199707c0c59250e3a670bcbb1005470627dbaf24
kdebase-devel-3.3.1-13.el4_8.1.s390x.rpm SHA-256: e62a5241e34e156ee52cd91e3badc97fc2613b6064a61ccc7619b20e541aaceb
s390
kdebase-3.3.1-13.el4_8.1.s390.rpm SHA-256: 37db7afc62420e24927e93a49a30efbf3d811bfda19cf29d45d710002419dd58
kdebase-devel-3.3.1-13.el4_8.1.s390.rpm SHA-256: 63edd650d42da1f499e33f7dc4ec62c1cf4bd6df76edf3028f86febd87450c0a

Red Hat Enterprise Linux for Power, big endian 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
ppc
kdebase-3.5.4-21.el5_5.1.ppc.rpm SHA-256: 641b7b4ac9d2392e6532e07435405fbcff2e2955873e5de7fecc42aae2c00aff
kdebase-3.5.4-21.el5_5.1.ppc64.rpm SHA-256: 7ebd77274854783b8605eea4da3e655c25d549bfee104e9183f8382ef706a3bf
kdebase-devel-3.5.4-21.el5_5.1.ppc.rpm SHA-256: 7abb7e0611543882e708bdf909b89dc30a7a46211cc8943a834d5327b7feaba8
kdebase-devel-3.5.4-21.el5_5.1.ppc64.rpm SHA-256: 78ec8508c63ba300374676ae697802d511ba0175158caaf7a52fc1063da320c4

Red Hat Enterprise Linux for Power, big endian 4

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
ppc
kdebase-3.3.1-13.el4_8.1.ppc.rpm SHA-256: c1087ed89559c20b4f6e3a4183b513ead163c0b6ff494320ba588ad21fa05ae5
kdebase-3.3.1-13.el4_8.1.ppc64.rpm SHA-256: 6568bc408919da013fafbb99b70f37d871ab5177d6636c34ba7e158fa93a8bd0
kdebase-devel-3.3.1-13.el4_8.1.ppc.rpm SHA-256: e08de3f60a719ad6f3902bd2f8b3722a8bbd2b194cc281084ad7297fc4b05e75

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8

SRPM
kdebase-3.3.1-13.el4_8.1.src.rpm SHA-256: a23a5c05fd5332ebf9b8c87e6a99f40849a37fbb4c47efcd32edbe9a93e4df96
ppc
kdebase-3.3.1-13.el4_8.1.ppc.rpm SHA-256: c1087ed89559c20b4f6e3a4183b513ead163c0b6ff494320ba588ad21fa05ae5
kdebase-3.3.1-13.el4_8.1.ppc64.rpm SHA-256: 6568bc408919da013fafbb99b70f37d871ab5177d6636c34ba7e158fa93a8bd0
kdebase-devel-3.3.1-13.el4_8.1.ppc.rpm SHA-256: e08de3f60a719ad6f3902bd2f8b3722a8bbd2b194cc281084ad7297fc4b05e75

Red Hat Enterprise Linux Server from RHUI 5

SRPM
kdebase-3.5.4-21.el5_5.1.src.rpm SHA-256: c365fd201f0b8bebbdc8c4e8b6ab484eaee2a562b7d1ddb89a869777f8fd3ba3
x86_64
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: ebd9defa647c75066d176b436c4cef506aaff799cd1b1b3556a9558f15d507f3
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55
kdebase-devel-3.5.4-21.el5_5.1.x86_64.rpm SHA-256: e038170d6672e83b6683c7e91f3e9bfb1a3befe4b719bd20a2d6f40c03cef389
i386
kdebase-3.5.4-21.el5_5.1.i386.rpm SHA-256: 67afb135376c2c5857c28e1f51151ba8b8c10c352451400a30c7948845795002
kdebase-devel-3.5.4-21.el5_5.1.i386.rpm SHA-256: 0f076b3cf3a82b60c5b06dd3065e5e28da8097a4e5c41e82761c2509ad79fd55

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.