Red Hat Bugzilla – Bug 1163778
CVE-2014-8651 kde-workspace: arbitrary code execution and local privilege escalation
Last modified: 2015-10-09 06:39:28 EDT
A security issue was found in KDE Clock KCM polkit helper. This helper which runs as root privileges takes the name of the ntp utility to run as argument. A local user could use this flaw to run arbitrary commands as root. Note the two patches. The first patch do not pass ntpUtility as an argument to datetime helper and also moves the detection of ntp utility location into the helper function.The second patch validate timezone before setting and ensures that the symlink /etc/localtime allways point to a file in /usr/share/timezones. Upstream fix: https://projects.kde.org/projects/kde/kde-workspace/repository/diff?rev=54d0bfb5effff9c8cf60da890b7728cbe36a454e&rev_to=fd2aa9deed44fad6107625ad7360157fea7296f6 References: http://seclists.org/oss-sec/2014/q4/520 http://seclists.org/oss-sec/2014/q4/552 https://www.kde.org/info/security/advisory-20141106-1.txt https://git.reviewboard.kde.org/r/120977/ Acknowledgements: Red Hat would like to thank David Edmundson for reporting this issue.
It's only effected in kde-workspace < 4.11.14, plasma-desktop < 5.1.1. we have kde-workspace-4.11.14 in fc > 19, so it's not effected in fedora.
4.11.14 is only in updates-testing. I'm tagging the updates as security updates and adding this bug now.
The updates filed by Rex Dieter: https://admin.fedoraproject.org/updates/kde-workspace-4.11.14-1.fc21 https://admin.fedoraproject.org/updates/kde-workspace-4.11.14-1.fc20 https://admin.fedoraproject.org/updates/kde-workspace-4.11.14-1.fc19
kde-workspace-4.11.14-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
kde-workspace-4.11.14-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
kde-workspace-4.11.14-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
Mitigation: Add a polkit rule to disable the org.kde.kcontrol.kcmclock.save action. This rule can be tweaked by configuring file /usr/share/polkit-1/actions/org.kde.kcontrol.kcmclock.policy no = NOT AUTHORIZED for inactive sessions <allow_inactive>no</allow_inactive> auth_admin = Administration Authorization is Required to perform such action. Change this to 'no' <allow_active>no</allow_active>