blob: 440e9e3de74326ec2fd31cccb202ba975d42db5e [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200503-22">
<title>KDE: Local Denial of Service</title>
KDE is vulnerable to a local Denial of Service attack.
<product type="ebuild">kde, dcopserver</product>
<announced>March 19, 2005</announced>
<revised>March 19, 2005: 01</revised>
<package name="kde-base/kdelibs" auto="yes" arch="*">
<unaffected range="ge">3.3.2-r7</unaffected>
<unaffected range="rge">3.2.3-r8</unaffected>
<vulnerable range="lt">3.3.2-r7</vulnerable>
KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. DCOP is KDE's simple IPC/RPC mechanism.
Sebastian Krahmer discovered that it is possible to stall the
dcopserver of other users.
<impact type="normal">
An attacker could exploit this to cause a local Denial of Service
by stalling the dcopserver in the authentication process. As a result
all desktop functionality relying on DCOP will cease to function.
There is no known workaround at this time.
All kdelibs users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose kde-base/kdelibs</code>
<uri link="">CAN-2005-0396</uri>
<metadata tag="submitter" timestamp="Mon, 14 Mar 2005 06:00:10 +0000">
<metadata tag="bugReady" timestamp="Sat, 19 Mar 2005 07:23:43 +0000">