[kde-announce] security update. kde-workspace, plasma-desktop: privilage escalation

https://www.kde.org/info/security/advisory-20141106-1.txt

KDE Project Security Advisory
=============================

Title:          kde-workspace, plasma-desktop: privilage escalation
Risk Rating:    Medium
CVE:            not yet allocated
Platforms:      All
Versions:       kde-workspace < 4.11.14, plasma-desktop < 5.1.1
Author:         David Edmundson davidedmundson@kde.org
Date:           06 November 2014

Overview
========

KDE workspace configuration module for setting the date and time has a
helper program
which runs as root for performing actions. This is secured with polkit.

This helper takes the name of the ntp utility to run as an argument.
This allows a hacker
to run any arbitrary command as root under the guise of updating the time.

Impact
======

An application can gain root priveledges from an admin user with
either misleading information
or no interaction.

On some systems the user will be shown a prompt to change the time.
However, if the system has
policykit-desktop-privileges installed, the datetime helper will be
invoked by an admin user
without any prompts.

Workaround
==========

Add a polkit rule to disable the org.kde.kcontrol.kcmclock.save action.

Solution
========

For kde-workspace 4 upgrade kde-workspace to 4.11.14 once released or
apply the following patch:

https://projects.kde.org/projects/kde/kde-workspace/repos...

For plasma-desktop 5 upgrade to plasma-desktop 5.1.1 once release or
apply the following patch:

https://projects.kde.org/projects/kde/workspace/plasma-de...

Credits
=======

Thanks to David Edmundson for finding and fixing the issue
_______________________________________________
kde-announce mailing list
kde-announce@kde.org
https://mail.kde.org/mailman/listinfo/kde-announce