KDE ArtsWrapper Local Privilege Escalation Vulnerability

Bugtraq ID:	18429
Class:	Design Error
CVE:	CVE-2006-2916
Remote:	No
Local:	Yes
Published:	Jun 14 2006 12:00AM
Updated:	Jan 30 2007 10:19PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	SuSE Linux Openexchange Server SuSE Linux Enterprise Server 9 SuSE Linux Desktop 1.0 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux -current S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server rPath rPath Linux 1 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 KDE KDE 3.5.3 KDE KDE 3.5.2 KDE KDE 3.5.1 KDE KDE 3.5 KDE KDE 3.4.3 KDE KDE 3.4.2 KDE KDE 3.4.1 + Redhat Fedora Core4 KDE KDE 3.4 KDE KDE 3.4 KDE KDE 3.3.2 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 s/390 + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 ppc + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mipsel + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 mips + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 m68k + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 hppa + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 arm + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 amd64 + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 alpha + Debian Linux 3.1 alpha + Debian Linux 3.1 + Debian Linux 3.1 + Debian Linux 3.1 KDE KDE 3.3.2 KDE KDE 3.3.1 + Redhat Fedora Core3 KDE KDE 3.3 KDE KDE 3.2.3 KDE KDE 3.2.2 + KDE KDE 3.2.2 + Redhat Fedora Core2 KDE KDE 3.2.1 KDE KDE 3.2 KDE KDE 3.1.5 KDE KDE 3.1.4 KDE KDE 3.1.3 + Redhat Desktop 3.0 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 KDE KDE 3.1.2 + KDE KDE 3.1.2 KDE KDE 3.1.1 a KDE KDE 3.1.1 + S.u.S.E. Linux Personal 8.2 + S.u.S.E. Linux Personal 8.2 KDE KDE 3.1 + Redhat Linux 9.0 i386 + SuSE Linux 8.1 + SuSE Linux 8.1 KDE KDE 3.0.5 b KDE KDE 3.0.5 a + Redhat Linux 8.0 i386 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 i386 KDE KDE 3.0.5 KDE KDE 3.0.4 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + Gentoo Linux 1.2 KDE KDE 3.0.3 a KDE KDE 3.0.3 + Conectiva Linux Enterprise Edition 1.0 + FreeBSD FreeBSD 4.7 -STABLE + FreeBSD FreeBSD 4.7 -STABLE + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 9.0 KDE KDE 3.0.2 + Mandriva Linux Mandrake 8.2 KDE KDE 3.0.1 KDE KDE 3.0 KDE aRts 1.2.x KDE aRts 1.0.x Gentoo Linux BEAST/BSE BEAST/BSE 0.7
Not Vulnerable:	BEAST/BSE BEAST/BSE 0.7.1

KDE ArtsWrapper Local Privilege Escalation Vulnerability

KDE's artswrapper utility is susceptible to a local privilege-escalation vulnerability because it fails to properly implement privilege-dropping functionality when used in conjunction with Linux 2.6 kernels.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

KDE ArtsWrapper Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

KDE ArtsWrapper Local Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and patches to address this issue.

Please see the referenced advisories for more information.


KDE aRts 1.2.x

• KDE arts-1.2.x.diff
  ftp://ftp.kde.org/pub/kde/security_patches/arts-1.2.x.diff


• Slackware arts-1.3.2-i486-2_slack10.1.tgz
  Slackware 10.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/

KDE aRts 1.0.x

• KDE arts-1.0.x-diff
  ftp://ftp.kde.org/pub/kde/security_patches/arts-1.0.x-diff

BEAST/BSE BEAST/BSE 0.7

• BEAST/BSE beast-0.7.1.tar.bz2
  ftp://beast.gtk.org/pub/beast/v0.7/beast-0.7.1.tar.bz2

KDE KDE 3.2.3

• Slackware kdebase-3.2.3-i486-4_slack10.0.tgz
  Slackware 10.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ kdebase-3.2.3-i486-4_slack10.0.tgz

KDE KDE 3.3.2

• Slackware kdebase-3.3.2-i486-3_slack10.1.tgz
  Slackware 10.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ kdebase-3.3.2-i486-3_slack10.1.tgz

KDE KDE 3.4.2

• Slackware kdebase-3.4.2-i486-3_slack10.2.tgz
  Slackware 10.2:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ kdebase-3.4.2-i486-3_slack10.2.tgz

KDE ArtsWrapper Local Privilege Escalation Vulnerability

References:

• KDE Home Page (KDE)
  
• NNOUNCE: BEAST/BSE v0.7.1 (Gtk.org)
  
• rPSA-2006-0105-1 arts (rPath)