MDKSA-2005:045 - Updated kdelibs packages fix vulnerabilities

[Mandrakelinux Security Team]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

__________________________________________________ _____________________

Mandrakelinux Security Update Advisory
__________________________________________________ _____________________

Package name: kdelibs
Advisory ID: MDKSA-2005:045
Date: February 17th, 2005

Affected versions: 10.0, 10.1, Corporate 3.0
__________________________________________________ ____________________

Problem Description:

A bug in the way kioslave handles URL-encoded newline (%0a)
characters before the FTP command was discovered. Because of this, it
is possible that a specially crafted URL could be used to execute any
ftp command on a remote server, or even send unsolicited email.

As well, Davide Madrisan discovered that dcopidlng created temporary
files in an insecure manner.

The updated packages are patched to deal with these issues.
__________________________________________________ _____________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1165
http://www.kde.org/info/security/advisory-20050101-1.txt
http://bugs.kde.org/show_bug.cgi?id=97608
__________________________________________________ ____________________

Updated Packages:

Mandrakelinux 10.0:
36c26678038288bba80c3d72c9a1e20a 10.0/RPMS/kdelibs-common-3.2-36.10.100mdk.i586.rpm
3db366da3e09c4237e2a88732faca7a7 10.0/RPMS/libkdecore4-3.2-36.10.100mdk.i586.rpm
38c354234f316a456b9ff82c9535546e 10.0/RPMS/libkdecore4-devel-3.2-36.10.100mdk.i586.rpm
6912a08ee5359a4fdb48cac88b1a038b 10.0/SRPMS/kdelibs-3.2-36.10.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
dd9a0f3b2adcb7b59831e8f0edd73cce amd64/10.0/RPMS/kdelibs-common-3.2-36.10.100mdk.amd64.rpm
7a20989e14ff56ac7dbabca376bfba12 amd64/10.0/RPMS/lib64kdecore4-3.2-36.10.100mdk.amd64.rpm
071d26aa2f356d2dcc2bff274425531b amd64/10.0/RPMS/lib64kdecore4-devel-3.2-36.10.100mdk.amd64.rpm
6912a08ee5359a4fdb48cac88b1a038b amd64/10.0/SRPMS/kdelibs-3.2-36.10.100mdk.src.rpm

Mandrakelinux 10.1:
0cfe09de4cb942b4368cd1de240b17fa 10.1/RPMS/kdelibs-common-3.2.3-103.1.101mdk.i586.rpm
d8022d4320136b4112c23341c1312af5 10.1/RPMS/libkdecore4-3.2.3-103.1.101mdk.i586.rpm
41a707aab07bf9638c03103d40bca306 10.1/RPMS/libkdecore4-devel-3.2.3-103.1.101mdk.i586.rpm
8a24af1c667e03470cf4528dbd86a164 10.1/SRPMS/kdelibs-3.2.3-103.1.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
0ddace363e075b7715ddf481e530eaa7 x86_64/10.1/RPMS/kdelibs-common-3.2.3-103.1.101mdk.x86_64.rpm
b22c35e586b9a26c85998b77904a7340 x86_64/10.1/RPMS/lib64kdecore4-3.2.3-103.1.101mdk.x86_64.rpm
3550dbe6d2c956442ecbda70fa71d9dd x86_64/10.1/RPMS/lib64kdecore4-devel-3.2.3-103.1.101mdk.x86_64.rpm
d8022d4320136b4112c23341c1312af5 x86_64/10.1/RPMS/libkdecore4-3.2.3-103.1.101mdk.i586.rpm
8a24af1c667e03470cf4528dbd86a164 x86_64/10.1/SRPMS/kdelibs-3.2.3-103.1.101mdk.src.rpm

Corporate 3.0:
d93acd6d0050a6a5b0abddb91a791db5 corporate/3.0/RPMS/kdelibs-common-3.2-36.10.C30mdk.i586.rpm
6e3073f7f0ac52b6fcf38d43261cb7c3 corporate/3.0/RPMS/libkdecore4-3.2-36.10.C30mdk.i586.rpm
c753a66a47496ee4f765384afafa88d0 corporate/3.0/RPMS/libkdecore4-devel-3.2-36.10.C30mdk.i586.rpm
f057bf8b85687559e57527247cdc1de7 corporate/3.0/SRPMS/kdelibs-3.2-36.10.C30mdk.src.rpm

Corporate 3.0/X86_64:
04adc6e0b68e461c0b8bf5c3d07e4cbc x86_64/corporate/3.0/RPMS/kdelibs-common-3.2-36.10.C30mdk.x86_64.rpm
71202f8a27e9fdb2846cd14c339b87fa x86_64/corporate/3.0/RPMS/lib64kdecore4-3.2-36.10.C30mdk.x86_64.rpm
01d20ae725a9127ca492b9f447f189c0 x86_64/corporate/3.0/RPMS/lib64kdecore4-devel-3.2-36.10.C30mdk.x86_64.rpm
f057bf8b85687559e57527247cdc1de7 x86_64/corporate/3.0/SRPMS/kdelibs-3.2-36.10.C30mdk.src.rpm
__________________________________________________ _____________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandrakelinux at:

http://www.mandrakesoft.com/security/advisories

If you want to report vulnerabilities, please contact

security_linux-mandrake.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCFVuMmqjQ0CJFipgRAj2uAKDypzAdIDIK3cDnfGlN1Q ZJrnyWTgCeLjwZ
WyFMDq1yWBQ1kRWTFdLApo8=
=oTms
-----END PGP SIGNATURE-----