Executive brief
A vulnerability in the KDE desktop environment's screen saver component allows a local user to overwrite system files. By creating a malicious symbolic link, an attacker can trick the system into writing data to a file it shouldn't access. This could lead to system instability or the corruption of important configuration files.
Technical details
The vulnerability is a symlink race condition/attack involving the '.kss.pid' file used by KDE screen savers. A local attacker can create a symbolic link from the expected location of the PID file to an arbitrary target file on the system. When the screen saver process attempts to write its process ID to '.kss.pid', it follows the symlink and overwrites the target file with its PID. This requires local access to the machine and can result in unauthorized modification of files, potentially leading to a denial of service or further system compromise depending on the file overwritten.
Affected products
- KDE KDE Desktop Environment Beta 3
Timeline
- 1998-02-06: disclosed