Here's your morning dose of uh-oh, a security researcher has made an unfortunate vulnerability in KDE public. Not something we usually cover, but since there's no fix available it's worth letting you know.
The issue relates to how KDE handles .desktop and .directory files, since on KDE they allow what they call "Shell Expansion" allowing some nasty code to be run. The other issue, is that KDE will automatically execute them without you even opening the files. Discovered by Dominik "zer0pwn" Penner, you can see their write-up of the issue here:
Using a specially crafted .desktop file a remote user could be compromised by simply downloading and viewing the file in their file manager, or by drag and dropping a link of it into their documents or desktop.
Sadly, this makes the security issue one that's quite easy for someone to exploit, as long as they get you to download something containing the malicious file.
On Twitter, the KDE team posted:
For the moment avoid downloading .desktop or .directory files and extracting archives from untrusted sources.
However, that might not be good enough. Going by what else Penner also said on Twitter, it's not just .desktop or .directory files as any unknown filetype can be detected by KDE as an application/desktop mimetype making it a lot worse than originally thought. As long as a file contains "[Desktop Entry]" at the top, it seems KDE will have a go at parsing it.
On top of that, the KDE team were not made aware of the issue before this was all made public. So if you're running KDE, time to be super careful until a patch is out. Hopefully all distributions shipping KDE will be keeping a close eye on this for when a patch is available.
Article taken from GamingOnLinux.com.
doomiebaby Aug 7, 2019
MessedUpHare Aug 7, 2019
Hopefully the KDE devs will be able to resolve this quickly for KDE users out there.
Sir_Diealot Aug 7, 2019
Quoting: chancho_zombiedon't read this
Spoiler, click me
[Desktop Entry]
Exec=/bin/thisisavirus
you are doomed!!
That one you have to actively click on, the problem here is the shell expansion in where you can say set the title to a dynamic value like "title[$ie]=$(/bin/thisisavirus)"
ElectricPrism Aug 7, 2019
I like KDE and KDE devs but as a Arch user KDE users have a lot of the "btw I use KDE" going on, except throw in a "and GNOME sucks!"
So if you are one of those people this is for you:
Haha!
Kdiff3 used to be able to compare directories with binary files without any trouble. Since about a quarter of a year it crashes all the time.
Konsole's dynamic icons are completely broken. If any tab ever receives notification it is there until the terminal is restarted. It used to clear and revert back to the default icon until someone wanted to make it more elegant at the end of December.
Quoting: ElectricPrismI honestly lol inside a little bit from all the shit KDE fanboys give Gnome seeing this crop up.
I like KDE and KDE devs but as a Arch user KDE users have a lot of the "btw I use KDE" going on, except throw in a "and GNOME sucks!"
So if you are one of those people this is for you:
Haha!
GNOME still sucks. :P
Stupendous Man Aug 7, 2019
I'm a bug bounty hunter myself and any ethical hacker knows not to just disclose a bug to the world as soon as you find it. Pathetic.
"file" is a utility that does a best guess at mime-type of a file, so they took this, extended it with some new kde features. They tried their best to make it work for all use cases they know of.
This probably included shell expansion at runtime to handle some requirement.
Then the mistake could have been that the "file" extended utility would do shell expansion to help resolve the actual type.
Honestly these kinds of mistakes happen, and the common "best practices" re security won't help you find it.
It could even be that originally it didn't do it, but some bugfix for some issue inadvertently made this possible.
So, please don't diss people for not being able to keep all context in memory when doing work.
(And the Gnome related comment is out of place, unrelated, and could even be considered as a form of harassment, so please don't do such trolling)
PhilSwitch Aug 7, 2019
Patreon
PayPal
See more from me