Bug 697042 – CVE-2011-1586 kdenetwork: incomplete fix for CVE-2010-1000

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 697042 - (CVE-2011-1586) CVE-2011-1586 kdenetwork: incomplete fix for CVE-2010-1000

Summary:	CVE-2011-1586 kdenetwork: incomplete fix for CVE-2010-1000

Status:	CLOSED ERRATA

Aliases:	CVE-2011-1586

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	public=20110411,reported=20110415,sou...
Keywords:	Security

Depends On:	697044 697045 697046
Blocks:
	Show dependency tree / graph

Reported:	2011-04-15 12:57 EDT by Vincent Danen
Modified:	2015-11-24 09:38 EST (History)
CC List:	12 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-07-31 05:18:15 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0465	normal	SHIPPED_LIVE	Important: kdenetwork security update	2011-04-21 12:57:07 EDT

Groups: None (edit)

Description Vincent Danen 2011-04-15 12:57:27 EDT

Ubuntu has noticed that the patch used to fix CVE-2010-1000 was incomplete [1].  It would fix things like ../../tmp/foo but did not catch a single leading ../ (such as ../foo/bar).
https://bugs.launchpad.net/ubuntu/+source/kdenetwork/+bug/757526

These patches from upstream fully fix it:

http://websvn.kde.org/branches/KDE/4.4/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227468&r2=1227467&pathrev=1227468&view=patch
http://websvn.kde.org/branches/KDE/4.5/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227469&r2=1227468&pathrev=1227469&view=patch

[1] https://bugs.launchpad.net/ubuntu/+source/kdenetwork/+bug/757526

Comment 2 Vincent Danen 2011-04-15 13:00:54 EDT

Created kdenetwork tracking bugs for this issue

Affects: fedora-all [bug 697044]

Comment 3 Vincent Danen 2011-04-15 15:39:35 EDT

This was assigned the name CVE-2011-1586.

Comment 4 Vincent Danen 2011-04-18 13:27:27 EDT

As with CVE-2010-1000, this issue only affects Red Hat Enterprise Linux 6 and Fedora because only KDE 4.x has the vulnerable functionality.  Older versions of KDE are not affected.

Comment 10 errata-xmlrpc 2011-04-21 12:57:13 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0465 https://rhn.redhat.com/errata/RHSA-2011-0465.html

Note You need to log in before you can comment on or make changes to this bug.