Bug 408811 (CVE-2007-5963)

KDE Security Team provided us with following draft or their security advisory:

KDE Security Advisory: KDM Denial of Service Vulnerability
Original Release Date: 2007-12-XX
URL: http://www.kde.org/info/security/advisory-200712XX-1.txt

0. References
        CVE-FIXME


1. Systems affected:

	KDM as shipped with KDE 3.2.0 up to including 3.5.8.


2. Overview:

	KDM can be tricked into hanging or eating memory by reading from
	special files (pipes or symlinks to devices), big or sparse files
	created in the users home directory.

	A regular user with a valid account is able to prepare his home
	directory in a way that will make login via KDM impossible for
	any user if KDM's user list display is enabled and users are
	permitted to add their own images. Given that the account can be
	identified easily, this issue is only sensitive for high
	security environments.

3. Impact:

	A regular user with a valid account is able to make login via KDM
	impossible. A regular user can also cause KDM to exceed the
	system resource limits.

3a. Workaround:

	The login DoS can be worked around by either disabling the user list
	feature entirely (UserList=false in kdmrc) or displaying only
	administratively assigned images (FaceSource=AdminOnly).

	The memory consumption issue can be worked around by setting an
	appropriate resource limit on KDM itself. Note that this affects 
	local X servers as well.

4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        A patch for KDE 3.3.0 - KDE 3.5.7 is available from
        ftp://ftp.kde.org/pub/kde/security_patches :

        205b2928f5a3b6f68527f33c05f56fb4  post-3.5.8-kdebase-kdm.diff