CVE-2003-0692
Summary
| CVE | CVE-2003-0692 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2003-10-06 04:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Kde | Kde | 1.1 | All | All | All |
| Operating System | Kde | Kde | 1.1.1 | All | All | All |
| Operating System | Kde | Kde | 1.1.2 | All | All | All |
| Operating System | Kde | Kde | 1.2 | All | All | All |
| Operating System | Kde | Kde | 2.0 | All | All | All |
| Operating System | Kde | Kde | 2.0.1 | All | All | All |
| Operating System | Kde | Kde | 2.0_beta | All | All | All |
| Operating System | Kde | Kde | 2.1 | All | All | All |
| Operating System | Kde | Kde | 2.1.1 | All | All | All |
| Operating System | Kde | Kde | 2.1.2 | All | All | All |
| Operating System | Kde | Kde | 2.2 | All | All | All |
| Operating System | Kde | Kde | 2.2.1 | All | All | All |
| Operating System | Kde | Kde | 2.2.2 | All | All | All |
| Operating System | Kde | Kde | 3.0 | All | All | All |
| Operating System | Kde | Kde | 3.0.1 | All | All | All |
| Operating System | Kde | Kde | 3.0.2 | All | All | All |
| Operating System | Kde | Kde | 3.0.3 | All | All | All |
| Operating System | Kde | Kde | 3.0.3a | All | All | All |
| Operating System | Kde | Kde | 3.0.4 | All | All | All |
| Operating System | Kde | Kde | 3.0.5 | All | All | All |
| Operating System | Kde | Kde | 3.0.5a | All | All | All |
| Operating System | Kde | Kde | 3.0.5b | All | All | All |
| Operating System | Kde | Kde | 3.1 | All | All | All |
| Operating System | Kde | Kde | 3.1.1 | All | All | All |
| Operating System | Kde | Kde | 3.1.1a | All | All | All |
| Operating System | Kde | Kde | 3.1.2 | All | All | All |
| Operating System | Kde | Kde | 3.1.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| '[KDE SECURITY ADVISORY] KDM vulnerabilities' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| [suse-security] pam_krb5 & kdm: local root compromise (or misconfiguration?) | af854a3a-2127-422b-91ae-364da2661108 | cert.uni-stuttgart.de | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Debian -- Security Information -- DSA-388-1 kdebase | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Patch, Vendor Advisory |
| Mandriva Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| www.kde.org/info/security/advisory-20030916-1.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | Patch, Vendor Advisory |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Patch, Vendor Advisory |
| Home - Conectiva | af854a3a-2127-422b-91ae-364da2661108 | distro.conectiva.com.br | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.