ubuntu ve kubuntu kapattý o acýðý...
Perþembe 15 Haziran 2006 20:35 tarihinde, Buðrahan Korkmaz þunlarý yazmýþtý: > Sanýrým KDM... > > 15.06.2006 tarihinde Ömer F. USTA <omerusta at gmail.com> yazmýþ: > > Merhaba > > Sanýrým biraz ayýp ettim. Kýsa bir özeti þu þekilde > > KDE nin grafiksel login ekraný olan KDM oturum türünün kullanýcý > > tarafýndan > > seçilmesini saðlamakta ve bunu her kullanýcýnýn kendi dizininde bir > > dosyada > > tutmakta. Eðer sen bu dosyayý bir sembolik bað ile deðiþtirirsen > > /etc/shadow dahil bircok dosyayý okuma imkanýn olur ki bu da sistemi > > çözmen/kýrman demektir. ( Bunun nasýl yapýlabileceðini sorma çünkü bende > > bilmiyorum :D ) > > Bu hatayý Ludwig Nussel isimli biri raporlamýþ. ve bu hata KDE'nin > > 3.2.0 sürümünden > > 3.5.3(yani þu anki son sürüm ) e kadar tüm KDE sürümlerinde mevcut. > > Bu açýðý kapatan yamayý ftp://ftp.kde.org/pub/kde/security_patches > > adresinden indirebilirsin > > (ama sanýrým orda sadece .diff þeklinde bulunacaktýr ve source koda > > yapýlabilecek bir > > patchtir (muhtemelen ). Pardus veya diðer daðýtýmlar için yama sanýrým > > henüz hazýr deðil) > > > > Not: Pardus KDM mi GDM mi kullanýyordu ? > > > > On 6/15/06, mengucek <mengucek at gmail.com> wrote: > > > merhaba... > > > kimbilir.. belki bir kardeþimiz çýkar ve bu "büyük açýðýn" Türkçe > > > > mealini.. > > > > > ucundan-bucaðýndan azýcýk açýklar :) > > > hatta.. lazýmsa-gerekliyse-mümkünse.. þunu-þöyle yap deyiverir.. > > > çünkü.. benim bu ingilizce balýðýný tutmayý öðrenmem çoook uzun iþ :) > > > hoþça kalýn :) > > > > > > Perþembe 15 Haziran 2006 10:36 tarihinde, Ömer F. USTA þunlarý yazmýþtý: > > > > 0. References > > > > > > > > CVE-2006-2449 > > > > > > > > > > > > 1. Systems affected: > > > > > > > > KDM as shipped with KDE 3.2.0 up to including 3.5.3. KDE > > > > 3.1.xand older and newer versions than KDE 3.5.3 are not affected. > > > > > > > > > > > > 2. Overview: > > > > > > > > KDM allows the user to select the session type for login. This > > > > setting is permanently stored in the user home directory. By > > > > using a symlink attack, KDM can be tricked into allowing the > > > > user to read file content that would otherwise be unreadable > > > > to this particular user. This vulnerability was discovered > > > > and reported by Ludwig Nussel. > > > > > > > > > > > > 3. Impact: > > > > > > > > KDM might allow a normal user to read the content of > > > > /etc/shadow or other files, which allows compromising the privacy of > > > > another > > > > > > user or even the security of the whole system. > > > > > > > > 4. Solution: > > > > > > > > Source code patches have been made available which fix these > > > > vulnerabilities. Contact your OS vendor / binary package > > > > provider > > > > > > for information about how to obtain updated binary packages. > > > > > > > > > > > > 5. Patch: > > > > > > > > A patch for KDE 3.4.0 - KDE 3.5.3 is available from > > > > ftp://ftp.kde.org/pub/kde/security_patches : > > > > > > > > 9daecff07d57dabba35da247e752916a post-3.5.0-kdebase-kdm.diff > > > > > > > > A patch for KDE 3.3.x is available from > > > > ftp://ftp.kde.org/pub/kde/security_patches : > > > > > > > > f2e1424d97f2cd18674bef833274c5e3 post-3.3.0-kdebase-kdm.diff > > > > > > > > A patch for KDE 3.2.x is available from > > > > ftp://ftp.kde.org/pub/kde/security_patches : > > > > > > > > 8aa6b41cccca4216c6eb1cf705c2370a post-3.2.0-kdebase-kdm.diff > > > > > > _______________________________________________ > > > Pardus-kullanicilari mailing list > > > Pardus-kullanicilari at uludag.org.tr > > > http://liste.uludag.org.tr/mailman/listinfo/pardus-kullanicilari > > > > -- > > Ömer Fadýl USTA > > http://www.bilisimlab.com/ > > _______________________________________________ > > Pardus-kullanicilari mailing list > > Pardus-kullanicilari at uludag.org.tr > > http://liste.uludag.org.tr/mailman/listinfo/pardus-kullanicilari
