Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | kdenetwork security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2011:0465 | First vendor Publication | 2011-04-21 |
| Vendor | RedHat | Last vendor Modification | 2011-04-21 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.8 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated kdenetwork packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: The kdenetwork packages contain networking applications for the K Desktop Environment (KDE). A directory traversal flaw was found in the way KGet, a download manager, handled the "file" element in Metalink files. An attacker could use this flaw to create a specially-crafted Metalink file that, when opened, would cause KGet to overwrite arbitrary files accessible to the user running KGet. (CVE-2011-1586) Users of kdenetwork should upgrade to these updated packages, which contain a backported patch to resolve this issue. The desktop must be restarted (log out, then log back in) for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 697042 - CVE-2011-1586 kdenetwork: incomplete fix for CVE-2010-1000 |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2011-0465.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13898 | |||
| Oval ID: | oval:org.mitre.oval:def:13898 | ||
| Title: | USN-1114-1 -- kdenetwork vulnerability | ||
| Description: | kdenetwork: networking applications for KDE 4 An attacker could overwrite files owned by the user if KGet opened a crafted metalink file. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1114-1 CVE-2011-1586 | Version: | 5 |
| Platform(s): | Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 | Product(s): | kdenetwork |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21934 | |||
| Oval ID: | oval:org.mitre.oval:def:21934 | ||
| Title: | RHSA-2011:0465: kdenetwork security update (Important) | ||
| Description: | Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0465-01 CVE-2011-1586 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | kdenetwork |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23429 | |||
| Oval ID: | oval:org.mitre.oval:def:23429 | ||
| Title: | ELSA-2011:0465: kdenetwork security update (Important) | ||
| Description: | Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0465-01 CVE-2011-1586 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | kdenetwork |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27759 | |||
| Oval ID: | oval:org.mitre.oval:def:27759 | ||
| Title: | DEPRECATED: ELSA-2011-0465 -- kdenetwork security update (important) | ||
| Description: | [7:4.3.4-11.1] - CVE-2010-1000, improper sanitization of metalink attribute for downloading files | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-0465 CVE-2011-1586 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | kdenetwork |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-06-06 | Name : RedHat Update for kdenetwork RHSA-2011:0465-01 File : nvt/gb_RHSA-2011_0465-01_kdenetwork.nasl |
| 2011-05-10 | Name : Ubuntu Update for kdenetwork USN-1114-1 File : nvt/gb_ubuntu_USN_1114_1.nasl |
| 2011-05-06 | Name : Mandriva Update for kdenetwork4 MDVSA-2011:081 (kdenetwork4) File : nvt/gb_mandriva_MDVSA_2011_081.nasl |
| 2011-04-22 | Name : Fedora Update for kdenetwork FEDORA-2011-5211 File : nvt/gb_fedora_2011_5211_kdenetwork_fc13.nasl |
| 2010-12-09 | Name : Fedora Update for kdenetwork FEDORA-2010-18029 File : nvt/gb_fedora_2010_18029_kdenetwork_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdemultimedia FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdemultimedia_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdeadmin FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeadmin_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdeartwork FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeartwork_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase-runtime FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdebase-runtime_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase-workspace FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdebase-workspace_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdebase_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdebindings FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdebindings_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdeedu FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeedu_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdegames FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdegames_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdegraphics FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdegraphics_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdelibs FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdelibs_fc11.nasl |
| 2010-05-28 | Name : Mandriva Update for kdenetwork4 MDVSA-2010:098 (kdenetwork4) File : nvt/gb_mandriva_MDVSA_2010_098.nasl |
| 2010-05-28 | Name : Fedora Update for kdenetwork FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdenetwork_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdepim-runtime FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdepim-runtime_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdepim FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdepim_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdepimlibs FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdepimlibs_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdeplasma-addons FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeplasma-addons_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdesdk FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdesdk_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdetoys FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdetoys_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kdeutils FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeutils_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for oxygen-icon-theme FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_oxygen-icon-theme_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kde-l10n FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kde-l10n_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for kde-l10n FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kde-l10n_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeaccessibility FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeaccessibility_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeadmin FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeadmin_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeartwork FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeartwork_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase-runtime FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdebase-runtime_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase-workspace FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdebase-workspace_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdebase FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdebase_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdebindings FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdebindings_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeedu FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeedu_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdegames FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdegames_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdegraphics FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdegraphics_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdelibs FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdelibs_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdemultimedia FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdemultimedia_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdenetwork FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdenetwork_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdepim-runtime FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdepim-runtime_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdepim FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdepim_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdepimlibs FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdepimlibs_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeplasma-addons FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeplasma-addons_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdesdk FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdesdk_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdetoys FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdetoys_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeutils FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_kdeutils_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for oxygen-icon-theme FEDORA-2010-8544 File : nvt/gb_fedora_2010_8544_oxygen-icon-theme_fc12.nasl |
| 2010-05-28 | Name : Fedora Update for kdeaccessibility FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdeaccessibility_fc11.nasl |
| 2010-05-17 | Name : Ubuntu Update for kdenetwork vulnerability USN-938-1 File : nvt/gb_ubuntu_USN_938_1.nasl |
| 2010-03-12 | Name : Mandriva Update for urpmi MDVA-2010:098 (urpmi) File : nvt/gb_mandriva_MDVA_2010_098.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 74943 | KDE KGet ui/metalinkcreator/metalinker.cpp KGetMetalink::File::isValidNameAtt... |
| 64690 | KDE KGet file Element name Attribute Traversal Arbitrary File Creation |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-08.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_kdenetwork4-101119.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0465.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110421_kdenetwork_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2011-06-13 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1114-1.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_kdenetwork4-101119.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_kdenetwork3-101119.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_kde4-kdnssd-101119.nasl - Type : ACT_GATHER_INFO |
| 2011-05-03 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-081.nasl - Type : ACT_GATHER_INFO |
| 2011-04-27 | Name : The remote Fedora host is missing a security update. File : fedora_2011-5774.nasl - Type : ACT_GATHER_INFO |
| 2011-04-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0465.nasl - Type : ACT_GATHER_INFO |
| 2011-04-21 | Name : The remote Fedora host is missing a security update. File : fedora_2011-5211.nasl - Type : ACT_GATHER_INFO |
| 2010-12-16 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_kde4-kdnssd-101119.nasl - Type : ACT_GATHER_INFO |
| 2010-12-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-18029.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-8577.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-8547.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-8544.nasl - Type : ACT_GATHER_INFO |
| 2010-05-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-098.nasl - Type : ACT_GATHER_INFO |
| 2010-05-14 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-938-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:54:37 |
|
| 2013-05-11 00:52:09 |
|
