Executive brief
The KDE file manager (kfm) contains a security flaw in how it handles file operations. Because it uses an unsecured network connection to process commands, a remote attacker could potentially modify or overwrite files on a user's system. This could lead to unauthorized access or the corruption of important configuration files.
Technical details
The KDE file manager (kfm) implements a TCP server to facilitate communication between desktop modules. This server lacks authentication and proper access controls, allowing any network-reachable attacker to send commands to the service. Specifically, an attacker can issue 'copy' commands to the server. If an attacker can place a malicious file on the target system (e.g., via anonymous FTP), they can then instruct kfm to copy that file into sensitive locations, such as a user's .rhosts file, to gain further access. The recommended fix is to migrate the communication mechanism from TCP sockets to AF_UNIX sockets with restricted file permissions.
Affected products
- KDE K Desktop Environment (KDE) Versions using kfm prior to May 1997
Timeline
- 1997-05-05: disclosed: Vulnerability reported on Bugtraq by Alan Cox
- 1997-05-05: advisory: NVD publication date