Liebe Kolleginnen und Kollegen,

bitte beachten Sie die folgende Sicherheitsmeldung.

Betroffene Software:

Paket kdegames, Juk, libksane, Kfloppy, Kmousetool, libkcddb, Kwordquiz,
Ksnakeduel, Kdf, Kde-print-manager, Picmi, Kdebindings, Kdepim-runtime,
Kspaceduel, Sweeper, Kdeutils, Kdegraphics-mobipocket, Kbounce, Kdeadmin,
Smokeqt, Kdeedu, Ksirk, Kmahjongg, Audiocd-kio, Kdiamond, Knavalbattle,
Kactivities, Klettres, Kross-interpreters, Bovo, Kjumpingcube, Jovie, Step,
Kmouth, Kdeplasma-addons, Katomic, Ksquares, Analitza, Kiten, Konsole,
libkmahjongg, Svgpart, Smokegen, Kmines, Kreversi, Kstars, Kig,
Kde-base-artwork, Kde-baseapps, Kremotecontrol, Bomber, Kamera, Killbots,
Kgeography, Kdegraphics-strigi-analyzer, Nepomuk-core, Ksudoku, Parley,
Konquest, Kigo, Ark, Kde-runtime, Klines, Kdetoys, Kcharselect,
Kdegraphics-thumbnailers, Kdeartwork, Kolourpaint, Kmplot, Khangman,
Kde-workspace, Nepomuk-widgets, Kubrick, Superkaramba, libkdegames,
Ktuberling, Kdemultimedia, Kbruch, Ruby-qt, Kanagram, Fail2ban,
Kdeaccessibility, libkipi, Kimono, Filelight, Kwallet, Kpat, Qyoto,
Kcolorchooser, Rocs, Kturtle, Granatier, Ruby-korundum, Kruler, Kmix,
Kajongg, Blinken, Dragon, Ksnapshot, Kiriki, Kscd, Okular, Ktouch, Kdesdk,
libkexiv2, Knetwalk, Kgoldrunner, Kcalc, Lskat, Kbreakout, Kmag, Kgamma,
libkcompactdisc, Kalgebra, Kdepimlibs, Kdepim, Kdegraphics, Ktimer, Kgpg,
libkdcraw, Kdenetwork, Kolf, Kalzium, libkdeedu, Palapeli, Kde-wallpapers,
Kshisen, Smokekde, Kblocks, Oxygen-icon-theme, Kaccessible, Pykde4,
Kollision, Cantor, Pairs, Gwenview, Kde-l10n, Ksaneplugin, Kblackbox, Kate,
Kfourinline, Kapman, Marble, Klickety

Betroffene Plattformen:

Fedora 17

Eine Schwachstelle in den KDE Plasma Addons, die auch zahlreiche andere
KDE-Anwendungen betrifft, ermöglicht einem lokalen Angreifer den Klartext
eines Passworts herzustellen.

Software Upgrade:

Der Hersteller stellt Updates zur Behebung der Schwachstelle bereit.

http://dl.fedoraproject.org/pub/fedora/linux/updates/

CVE-2013-2120: Schwachstelle in den KDE Plasma Addons

Der PasteMacroExpander des Paste Applet in den KDE Plasma Addons erzeugt in
der Datei ‘pastemacroexpander.cpp’ Passwörter, dessen Grad an Zufälligkeit
sehr begrenzt ist. Dies ermöglicht einem lokalen Angreifer den Klartext
eines generierten Passwortes herzustellen und somit unerlaubten Zugriff auf
Ressourcen zu erlangen.

Referenzen:

Dieses Advisory finden Sie auch im DFN-CERT Portal unter:
https://portal.cert.dfn.de/adv/DFN-CERT-2013-1127/

Das Hersteller Advisory:
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109109.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109078.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109208.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109126.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109181.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109190.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109135.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109121.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109211.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109153.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109182.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109171.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109125.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109107.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109123.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109203.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109173.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109207.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109111.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109103.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109089.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109108.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109172.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109147.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109081.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109128.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109154.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109098.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109146.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109167.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109142.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109100.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109079.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109214.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109092.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109152.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109174.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109097.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109138.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109143.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109162.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109148.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109187.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109165.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109209.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109204.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109176.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109105.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109134.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109189.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109106.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109164.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109077.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109082.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109139.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109130.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109112.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109177.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109216.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109160.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109073.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109133.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109156.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109094.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109114.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109140.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109104.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109205.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109212.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109085.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109076.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109191.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109145.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109161.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109155.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109136.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109132.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109198.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109199.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109183.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109118.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109095.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109201.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109179.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109102.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109169.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109141.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109101.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109090.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109188.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109195.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109166.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109158.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109144.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109213.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109099.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109163.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109202.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109192.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109200.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109080.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109175.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109074.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109151.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109180.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109197.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109194.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109115.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109127.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109093.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109193.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109129.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109083.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109215.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109206.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109159.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109170.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109086.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109122.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109113.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109084.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109196.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109087.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109116.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109091.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109168.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109184.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109075.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109117.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109137.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109185.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109150.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109110.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109186.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109131.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109149.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109178.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109120.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109210.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109157.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109096.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109088.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109124.html

Schwachstelle CVE-2013-2120:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2120

(c) DFN-CERT Services GmbH
Die nicht kommerzielle Weiterverbreitung ist mit Hinweis auf den
Copyrightinhaber erlaubt.