KDE Parameter Quoting Shell Command Execution Vulnerability

BID:6462

Info

KDE Parameter Quoting Shell Command Execution Vulnerability

Bugtraq ID: 6462
Class: Design Error
CVE: CVE-2002-1393
Remote: Yes
Local: No
Published: Dec 22 2002 12:00AM
Updated: Jul 11 2009 07:17PM
Credit: Vulnerability announced in a KDE Security Advisory.
Vulnerable: KDE KDE 3.0.5
KDE KDE 3.0.4
+ Gentoo Linux 1.4 _rc1
 + Gentoo Linux 1.2
+ Gentoo Linux 1.2
KDE KDE 3.0.3 a
KDE KDE 3.0.3
+ Conectiva Linux Enterprise Edition 1.0
+ FreeBSD FreeBSD 4.7 -STABLE
 + FreeBSD FreeBSD 4.7 -STABLE
 + Mandriva Linux Mandrake 9.0
+ Mandriva Linux Mandrake 9.0
KDE KDE 3.0.2
+ Mandriva Linux Mandrake 8.2
KDE KDE 3.0.1
KDE KDE 3.0
KDE KDE 2.2.2
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Debian Linux 3.0
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.1
+ Redhat Advanced Workstation for the Itanium Processor 2.1
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 i386
 + Redhat Linux Advanced Work Station 2.1
+ Sun Linux 5.0.7
+ Sun Linux 5.0.7
+ Sun Linux 5.0.6
+ Sun Linux 5.0.6
+ Sun Linux 5.0.5
+ Sun Linux 5.0.5
KDE KDE 2.2.1
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ Caldera OpenLinux Workstation 3.1
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
KDE KDE 2.2
KDE KDE 2.1.2
KDE KDE 2.1.1
KDE KDE 2.1
KDE KDE 2.0.1
KDE KDE 2.0
Not Vulnerable: KDE KDE 3.0.5 a
+ Redhat Linux 8.0 i386
 + Redhat Linux 7.3 i386
 + Redhat Linux 7.3 i386

Discussion

KDE Parameter Quoting Shell Command Execution Vulnerability

KDE is a freely available, open source X Desktop Manager. It has application features to make systems user-friendly, and is designed for Unix and Linux operating systems.

It has been discovered that KDE insecurely handles some types of input. Under some circumstances, KDE does not properly quote parameters of commands passed to the command shell. By creating a custom, malicious string in an attacker-controlled medium of delivery, it would be possible execute commands with the privileges of the user receiving the malicious string.

Exploit / POC

KDE Parameter Quoting Shell Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

KDE Parameter Quoting Shell Command Execution Vulnerability

Solution:
Red Hat has released a security advisory (RHSA-2003:002-01), which addresses the issue. Please see the attached advisory for details on obtaining fixes.

Gentoo Linux has released an advisory. Users who have installed kde-base/kde-3.0.4 and earlier are advised to upgrade their systems by issuing the following commands:

emerge rsync
emerge kde
emerge clean

Gentoo Linux has released a new advisory. Users who have installed kde-base/kde-2.2.x are advised to upgrade their systems to kde*-2.2.2-{r1,r2,r4} by issuing the following commands:

emerge sync
emerge -u \=kde-base/kde-2.2*
emerge clean

Debian has released advisories (DSA 234-1, DSA 235-1, DSA 236-1, DSA 237-1, DSA 238-1, DSA 239-1, DSA 240-1, DSA 241-1, DSA 242-1, DSA 243-1) which address this issue.

Debian users using the apt-get package manager are advised to upgrade their systems by issuing the following commands:
apt-get update or
apt-get upgrade

Please see the attached Debian advisories for details on obtaining and applying fixes.

Conectiva has released a security advisory (CLA-2003:569) which addresses the issue. Please see the attached advisory for details on obtaining fixes.

Fixes have been made available by the vendor. See attached reference.

Sun has released updates for Sun Linux 5.0.5.

Fixes available:


KDE KDE 2.2.2

KDE KDE 3.0.3

References

KDE Parameter Quoting Shell Command Execution Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report