openSUSE Security Update: KDE KDM local root exploit (CVE-2010-0436) ______________________________________________________________________________
Announcement ID: openSUSE-SU-2010:0112-1 Rating: important References: #584223 Cross-References: CVE-2010-0436 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________
An update that fixes one vulnerability is now available. It includes one version update.
Description:
The KDE KDM contains a local race condition which allows to make arbitrary files world writable. CVE-2010-0436 has been assigned to this issue.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch kde4-kdm-2134
- openSUSE 11.1:
zypper in -t patch fileshareset-2204 kde4-kdm-2134
- openSUSE 11.0:
zypper in -t patch fileshareset-2204 kde4-kdm-2134
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64) [New Version: 4.3.5]:
kdebase4-workspace-4.3.5-0.3.1
- openSUSE 11.2 (i586 x86_64) [New Version: 4.3.5]:
kde4-kgreeter-plugins-4.3.5-0.3.1 kdebase4-workspace-branding-upstream-4.3.5-0.3.1 kdebase4-workspace-devel-4.3.5-0.3.1 kdebase4-workspace-google-gadgets-4.3.5-0.3.1 kdebase4-workspace-ksysguardd-4.3.5-0.3.1 kdm-4.3.5-0.3.1 kdm-branding-upstream-4.3.5-0.3.1 kwin-4.3.5-0.3.1
- openSUSE 11.1 (i586 ppc src x86_64):
kdebase3-3.5.10-17.5.1 kdebase4-workspace-4.1.3-10.4.1
- openSUSE 11.1 (i586 ppc x86_64):
fileshareset-2.0-17.5.1 kde4-kdm-4.1.3-10.4.1 kde4-kdm-branding-upstream-4.1.3-10.4.1 kde4-kgreeter-plugins-4.1.3-10.4.1 kde4-kwin-4.1.3-10.4.1 kdebase3-beagle-3.5.10-17.5.1 kdebase3-devel-3.5.10-17.5.1 kdebase3-extra-3.5.10-17.5.1 kdebase3-kdm-3.5.10-17.5.1 kdebase3-nsplugin-3.5.10-17.5.1 kdebase3-runtime-3.5.10-17.5.1 kdebase3-samba-3.5.10-17.5.1 kdebase3-session-3.5.10-17.5.1 kdebase4-workspace-branding-upstream-4.1.3-10.4.1 kdebase4-workspace-devel-4.1.3-10.4.1 kdebase4-workspace-ksysguardd-4.1.3-10.4.1 misc-console-font-3.5.10-17.5.1
- openSUSE 11.1 (x86_64):
kdebase3-32bit-3.5.10-17.5.1 kdebase3-runtime-32bit-3.5.10-17.5.1
- openSUSE 11.0 (i586 ppc src x86_64):
kdebase3-3.5.9-65.4 kdebase4-workspace-4.0.4-24.8
- openSUSE 11.0 (i586 ppc x86_64):
fileshareset-2.0-501.4 kde4-kdm-4.0.4-24.8 kde4-kdm-branding-upstream-4.0.4-24.8 kde4-kwin-4.0.4-24.8 kdebase3-beagle-3.5.9-65.4 kdebase3-devel-3.5.9-65.4 kdebase3-extra-3.5.9-65.4 kdebase3-kdm-3.5.9-65.4 kdebase3-runtime-3.5.9-65.4 kdebase3-samba-3.5.9-65.4 kdebase3-session-3.5.9-65.4 kdebase4-workspace-branding-upstream-4.0.4-24.8 kdebase4-workspace-devel-4.0.4-24.8 kdebase4-workspace-ksysguardd-4.0.4-24.8 misc-console-font-3.5.9-65.4
- openSUSE 11.0 (i586 ppc):
kdebase3-nsplugin-3.5.9-65.4
- openSUSE 11.0 (x86_64):
kdebase3-32bit-3.5.9-65.4 kdebase3-runtime-32bit-3.5.9-65.4
- openSUSE 11.0 (ppc):
kdebase3-64bit-3.5.9-65.4 kdebase3-runtime-64bit-3.5.9-65.4
References:
http://support.novell.com/security/cve/CVE-2010-0436.html https://bugzilla.novell.com/584223