KDE Linux users still at risk from flaw

By Matthew Broersma

May 19, 2005 12:00 PM ET

TechWorld.com - Linux users who patched their systems for a serious security vulnerability in K Desktop Environment last month will have to patch once again, because of errors in the original patch, according to the KDE project.

The vulnerability affects kdelibs, specifically an error in the kimgio component when processing PCX image files. Kimgio is used in KHTML-based Web browsers as well as KDE imaging applications such as kpresenter and ksnapshot, meaning that if an image crafted to exploit the flaw were viewed in any of these applications, they could allow an attacker to execute malicious code and take over a system. The flaw affects KDE Versions 3.2 to 3.4, according to KDE.

The patches issued last month fixed most of the problems but still allowed local users to exploit the bug by serving files from the /tmp directory, KDE said in an advisory. They also introduced a new bug, breaking kimgio's compatibility with .rgb images.

The problems will mean a fresh round of patching for Unix-derived systems using KDE, one of the two most popular desktop environments for Unix and Linux. KDE released a new patch fixing the problems with the original patch, and operating system vendors such as Red Hat and SUSE have followed suit this week.

Software vendors are under pressure to deliver timely patches, but faulty updates are not unknown as a result, say security experts. This week, for instance, Microsoft re-released a critical security update after it caused networking problems for many users.

Such problems can mean a major headache for system administrators, but they seem to be on the wane, according to Thomas Kristensen, chief technology officer at Danish security firm Secunia. "Generally speaking, I'd say that most vendors have improved significantly over the last two years when it comes to quality testing of their security fixes," he said.

Reprinted with permission from

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Extending COBOL to SOA, Web Services and Beyond
Most businesses have come to realize that recycling or reusing proven processes in combination with newer technologies addresses current and future business needs....

Usability Is Everything
Learn what sets Workday's HR and Payroll solutions apart from the competition....

Extend, Replace, or Convert; which is the best way forward for COBOL Applications?
There are a number of choices when looking at ways to take existing COBOL applications forward. This white paper discusses the most common...

The Value of Real SaaS at Workday
Cost savings, speed to value, and innovation brought to the enterprise by Workday's software-as-a-service solutions for HR and Payroll....

Accelerate SSL Encrypted Applications
The amount of SSL traffic is growing in the enterprise. Because it is encrypted, it cannot be properly controlled and accelerated. Blue Coat...

SaaS at Flextronics, Inc.
Dave Smoley, CIO of Flextronics, discusses the real value of software-as-a-service and why he chose Workday for his HR solution....

ESG Lab Field Audit
Many companies have successfully implemented Riverbed WAN optimization solutions within their Cisco networks. This ESG Lab Field Audit document explores the success that...

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

Shape Your Apps Strategy to Reflect New SaaS Licensing and Pricing Trends
Why are smart companies choosing software-as-a-service? Find out in the complimentary Forrester Research report...

Agile Enterprise Content Management (ECM) for Rapid ROI
Find out how combining ECM and BPM will help adress issues about content rich business processes....

All White Papers | All Webcasts