<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> <glsa id="200504-23"> <title>Kommander: Insecure remote script execution</title> <synopsis> Kommander executes remote scripts without confirmation, potentially resulting in the execution of arbitrary code. </synopsis> <product type="ebuild">Kommander</product> <announced>2005-04-22</announced> <revised count="02">2005-05-20</revised> <bug>89092</bug> <access>remote</access> <affected> <package name="kde-base/kdewebdev" auto="yes" arch="*"> <unaffected range="ge">3.3.2-r2</unaffected> <vulnerable range="lt">3.3.2-r2</vulnerable> </package> </affected> <background> <p> KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. Kommander is a visual dialog editor and interpreter for KDE applications, part of the kdewebdev package. </p> </background> <description> <p> Kommander executes data files from possibly untrusted locations without user confirmation. </p> </description> <impact type="normal"> <p> An attacker could exploit this to execute arbitrary code with the permissions of the user running Kommander. </p> </impact> <workaround> <p> There is no known workaround at this time. </p> </workaround> <resolution> <p> All kdewebdev users should upgrade to the latest version: </p> <code> # emerge --sync # emerge --ask --oneshot --verbose ">=kde-base/kdewebdev-3.3.2-r2"</code> </resolution> <references> <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0754">CAN-2005-0754</uri> <uri link="https://www.kde.org/info/security/advisory-20050420-1.txt">KDE Security Advisory: Kommander untrusted code execution</uri> </references> <metadata tag="submitter" timestamp="2005-04-22T06:18:02Z"> jaervosz </metadata> <metadata tag="bugReady" timestamp="2005-04-22T06:48:56Z"> jaervosz </metadata> </glsa>