A CVE has been issued for a security issue fixed upstream in kde-cli-tools: http://openwall.com/lists/oss-security/2016/09/29/7 Cauldron should have this fix soon if it doesn't have it already. kdesu is in kdebase4-runtime in Mageia 5 and may also be affected.
already fixed in plasma 5.7.95 New package in mga5 updates_testing.
CC: (none) => mageia
openSUSE has issued an advisory for this on October 11: https://lists.opensuse.org/opensuse-updates/2016-10/msg00034.html
URL: (none) => http://lwn.net/Vulnerabilities/703329/
Depends on: (none) => 17123
Depends on: 17123 => (none)
Nicolas committed the patch to fix this but never built it. Patched package uploaded for Mageia 5. Advisory: ======================== Updated kdebase4-runtime packages fix security vulnerability: A user could sneak an unicode string terminator in the kdesu invocation, which could hide the fact that more commands could be executed (CVE-2016-7787). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7787 http://openwall.com/lists/oss-security/2016/09/29/7 https://lists.opensuse.org/opensuse-updates/2016-10/msg00034.html ======================== Updated packages in core/updates_testing: ======================== kdebase4-runtime-4.14.3-5.1.mga5 khelpcenter-4.14.3-5.1.mga5 khelpcenter-handbook-4.14.3-5.1.mga5 kdebase4-runtime-handbook-4.14.3-5.1.mga5 kwallet-daemon-4.14.3-5.1.mga5 libkwalletbackend4-4.14.3-5.1.mga5 libmolletnetwork4-4.14.3-5.1.mga5 kdebase4-runtime-devel-4.14.3-5.1.mga5 from kdebase4-runtime-4.14.3-5.1.mga5.src.rpm
CC: (none) => kdeAssignee: kde => qa-bugs
on mga5-64 packages installed cleanly: - kdebase4-runtime-4.14.3-5.1.mga5.x86_64 - kdebase4-runtime-handbook-4.14.3-5.1.mga5.noarch - khelpcenter-4.14.3-5.1.mga5.x86_64 - khelpcenter-handbook-4.14.3-5.1.mga5.noarch - kwallet-daemon-4.14.3-5.1.mga5.x86_64 - lib64kwalletbackend4-4.14.3-5.1.mga5.x86_64 - lib64molletnetwork4-4.14.3-5.1.mga5.x86_64 Have had this running for two days, using a variety of commonly used applications No regressions noted. Looks OK for mga5-64 However I do not use kwallet, and so perhaps should be tested by someone who does.
CC: (none) => jim
Testing Mageia 5 x64. kdebase4-runtime-4.14.3-5.1.mga5 kdebase4-runtime-handbook-4.14.3-5.1.mga5 khelpcenter-4.14.3-5.1.mga5 khelpcenter-handbook-4.14.3-5.1.mga5 kwallet-daemon-4.14.3-5.1.mga5 lib64kwalletbackend4-4.14.3-5.1.mga5 lib64molletnetwork4-4.14.3-5.1.mga5 I have had this update in use for some hours. For the first session, among other things I did quite a lot of KDE configuration. Soon after, it froze. This seems from the mailList to be a known - if occasional - problem, hence which I am not attributing to this update. I re-started the X-server (Ctrl/Backspace/Backspace), and have been running fine ever since. Seconding James' 64-bit M5 OK, but wait a bit for others.
CC: (none) => lewyssmithKeywords: (none) => advisory
Keep in mind that this update only impacts kdesu.
To prioritise.
CC: lewyssmith => (none)
First I've even heard of kdesu, so I did a little research. Looks like it could be a handy thing to have. After installing the update, I placed a link to /lib64/kde4/libexec/kdesu in /usr/bin to make the command easier to use. I then started dolphin, kwrite, Okular, and Firefox as root, using the kdesu command. I did not try any of the other options. Everything seemed to work as it should. The apps all opened with root privileges. Going to tentatively put a 64-bit OK in the Whiteboard. If further testing is needed, I'll give it a shot, but I'll need instructions.
CC: (none) => andrewsfarmWhiteboard: (none) => MGA5-64-OK
Thanks TJ - a good investigation. I tried it also, but difficult to know that <whatever> was running with root privileges. Via kdesu, created a file using Leafpad and checked its permissions with Dolphin: owned by root. Weakly confirms TJ. Validating as the update is M5 only, test x64.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Easiest to tell if you run Dolphin. If running as root, mine opens in /root, which is root's "home" directory. When dolphin is opened by a user, /root cannot be accessed.
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2017-0473.html
Status: NEW => RESOLVEDResolution: (none) => FIXED