Bug 1740138 (CVE-2019-14744) - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
Summary: CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14744
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1740141 1740140 1740736 1740737 1826816 1826817 1826818
Blocks: 1740142
TreeView+ depends on / blocked
 
Reported: 2019-08-12 11:04 UTC by Marian Rehak
Modified: 2021-02-16 21:31 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the KDE Frameworks KConfig prior to version 5.61.0. Certain syntax commands were allowed in .desktop, .directory, and configuration files to allow flexible configurations with the desktop environment. An attacker could add malicious code to a file that a user would unintentionally install, thus executing the malicious code. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2019-09-04 13:07:37 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2606 0 None None None 2019-09-03 17:41:50 UTC
Red Hat Product Errata RHSA-2020:2833 0 None None None 2020-07-07 10:14:55 UTC

Description Marian Rehak 2019-08-12 11:04:21 UTC
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

External References:

https://kde.org/info/security/advisory-20190807-1.txt

Comment 1 Marian Rehak 2019-08-12 11:05:53 UTC
Created kdelibs tracking bugs for this issue:

Affects: fedora-all [bug 1740140]

Comment 2 Marian Rehak 2019-08-12 11:07:03 UTC
Created kdelibs3 tracking bugs for this issue:

Affects: epel-7 [bug 1740141]

Comment 3 Kevin Kofler 2019-08-12 11:42:35 UTC
If you create a kdelibs3 fedora-all tracker, I'll add it to the updates already in Bodhi:
https://bodhi.fedoraproject.org/updates/FEDORA-2019-f9f78895c3 (Fedora 30)
https://bodhi.fedoraproject.org/updates/FEDORA-2019-9f2ee52c88 (Fedora 29)
(I already added this metatracker there.)

Comment 7 Product Security DevOps Team 2019-08-12 20:47:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14744

Comment 9 Stefan Cornelius 2019-08-13 15:13:57 UTC
Statement:

This issue affects the versions of kdelibs as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 10 Fedora Update System 2019-08-14 01:05:36 UTC
kde-settings-30.3-1.fc30, kdelibs-4.14.38-15.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2019-08-19 01:02:02 UTC
kdelibs3-3.5.10-101.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2019-08-19 02:29:19 UTC
kdelibs3-3.5.10-101.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2019-08-30 00:49:34 UTC
kde-settings-29.1-1.fc29, kdelibs-4.14.38-15.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 errata-xmlrpc 2019-09-03 17:41:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2606 https://access.redhat.com/errata/RHSA-2019:2606

Comment 15 Product Security DevOps Team 2019-09-04 13:07:37 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14744

Comment 17 errata-xmlrpc 2020-07-07 10:14:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:2833 https://access.redhat.com/errata/RHSA-2020:2833


Note You need to log in before you can comment on or make changes to this bug.