Here's your morning dose of uh-oh, a security researcher has made an unfortunate vulnerability in KDE public. Not something we usually cover, but since there's no fix available it's worth letting you know.
The issue relates to how KDE handles .desktop and .directory files, since on KDE they allow what they call "Shell Expansion" allowing some nasty code to be run. The other issue, is that KDE will automatically execute them without you even opening the files. Discovered by Dominik "zer0pwn" Penner, you can see their write-up of the issue here:
Using a specially crafted .desktop file a remote user could be compromised by simply downloading and viewing the file in their file manager, or by drag and dropping a link of it into their documents or desktop.
Sadly, this makes the security issue one that's quite easy for someone to exploit, as long as they get you to download something containing the malicious file.
On Twitter, the KDE team posted:
For the moment avoid downloading .desktop or .directory files and extracting archives from untrusted sources.
However, that might not be good enough. Going by what else Penner also said on Twitter, it's not just .desktop or .directory files as any unknown filetype can be detected by KDE as an application/desktop mimetype making it a lot worse than originally thought. As long as a file contains "[Desktop Entry]" at the top, it seems KDE will have a go at parsing it.
On top of that, the KDE team were not made aware of the issue before this was all made public. So if you're running KDE, time to be super careful until a patch is out. Hopefully all distributions shipping KDE will be keeping a close eye on this for when a patch is available.
Article taken from GamingOnLinux.com.
Some you may have missed, popular articles from the last month:
The comments on this article are closed.
doomiebaby Aug 7, 2019
what in the...
0 Likes
Sir_Diealot Aug 7, 2019
Not at all surprised, I expect that to be the tip of the iceberg. DEs tend to focus on snazzy wallpapers more than anything else.
2 Likes, Who?
Quoting: chancho_zombiedon't read this
Spoiler, click me
[Desktop Entry]
Exec=/bin/thisisavirus
you are doomed!!
That one you have to actively click on, the problem here is the shell expansion in where you can say set the title to a dynamic value like "title[$ie]=$(/bin/thisisavirus)"
9 Likes, Who?
ElectricPrism Aug 7, 2019
I honestly lol inside a little bit from all the shit KDE fanboys give Gnome seeing this crop up.
I like KDE and KDE devs but as a Arch user KDE users have a lot of the "btw I use KDE" going on, except throw in a "and GNOME sucks!"
So if you are one of those people this is for you:
Haha!
I like KDE and KDE devs but as a Arch user KDE users have a lot of the "btw I use KDE" going on, except throw in a "and GNOME sucks!"
So if you are one of those people this is for you:
Haha!
7 Likes, Who?
That does not surprise me at all. The developers seem to think that beautiful code is the most important goal. Again and again regressions are caused by removing “unnecessary” edge cases to make things more elegant.
Kdiff3 used to be able to compare directories with binary files without any trouble. Since about a quarter of a year it crashes all the time.
Konsole's dynamic icons are completely broken. If any tab ever receives notification it is there until the terminal is restarted. It used to clear and revert back to the default icon until someone wanted to make it more elegant at the end of December.
Kdiff3 used to be able to compare directories with binary files without any trouble. Since about a quarter of a year it crashes all the time.
Konsole's dynamic icons are completely broken. If any tab ever receives notification it is there until the terminal is restarted. It used to clear and revert back to the default icon until someone wanted to make it more elegant at the end of December.
2 Likes, Who?
Quoting: ElectricPrismI honestly lol inside a little bit from all the shit KDE fanboys give Gnome seeing this crop up.
I like KDE and KDE devs but as a Arch user KDE users have a lot of the "btw I use KDE" going on, except throw in a "and GNOME sucks!"
So if you are one of those people this is for you:
Haha!
GNOME still sucks. :P
22 Likes, Who?
Stupendous Man Aug 7, 2019
Why didn't they notify the KDE team BEFORE publishing their write-up? That's what responsible disclosure is all about, and would have avoided this situation! Give the team a couple months to patch, and THEN make the write-up.
I'm a bug bounty hunter myself and any ethical hacker knows not to just disclose a bug to the world as soon as you find it. Pathetic.
I'm a bug bounty hunter myself and any ethical hacker knows not to just disclose a bug to the world as soon as you find it. Pathetic.
25 Likes, Who?
So, as a developer that worked with security researchers I see these two sides of the coin:
"file" is a utility that does a best guess at mime-type of a file, so they took this, extended it with some new kde features. They tried their best to make it work for all use cases they know of.
This probably included shell expansion at runtime to handle some requirement.
Then the mistake could have been that the "file" extended utility would do shell expansion to help resolve the actual type.
Honestly these kinds of mistakes happen, and the common "best practices" re security won't help you find it.
It could even be that originally it didn't do it, but some bugfix for some issue inadvertently made this possible.
So, please don't diss people for not being able to keep all context in memory when doing work.
(And the Gnome related comment is out of place, unrelated, and could even be considered as a form of harassment, so please don't do such trolling)
"file" is a utility that does a best guess at mime-type of a file, so they took this, extended it with some new kde features. They tried their best to make it work for all use cases they know of.
This probably included shell expansion at runtime to handle some requirement.
Then the mistake could have been that the "file" extended utility would do shell expansion to help resolve the actual type.
Honestly these kinds of mistakes happen, and the common "best practices" re security won't help you find it.
It could even be that originally it didn't do it, but some bugfix for some issue inadvertently made this possible.
So, please don't diss people for not being able to keep all context in memory when doing work.
(And the Gnome related comment is out of place, unrelated, and could even be considered as a form of harassment, so please don't do such trolling)
10 Likes, Who?
PhilSwitch Aug 7, 2019
Well, time to switch back to XFCE. I only have to re-do my config.
4 Likes, Who?
Philadelphus Aug 7, 2019
Ooh, ouch. Not a great situation. :O Stay safe, our KDE-using friends!
4 Likes, Who?
Quote"To be honest, I was debating on going into the code and making the change myself considering KDE is open source," Penner said.
This guy, man... he had a good idea, but threw it all away for his 5 minutes in the limelight.
In any case, you'd think that after "Bad Taste" (https://nvd.nist.gov/vuln/detail/CVE-2017-11421) DE devs would've learned to not allow code execution in thumbnail display. I'll grant that Bad Taste was a bit more specific than the one KDE has at the moment.
3 Likes, Who?
I have cleaned up some comments and those that referenced the hateful comment.
GOL is an open community, if I see anyone again say inclusion is "cancer" they will get a hard ban.
GOL is an open community, if I see anyone again say inclusion is "cancer" they will get a hard ban.
20 Likes, Who?
Never before have I been so reluctant to press like on a GoL article... :|
This is a sobering reminder that nothing is ever completely safe or bug free. I assume there are plenty of Linux gamers who don't hang regularly on more hardcore sites where these things are normally featured.
Kudos to GoL for reporting on this. Awareness is half the battle.
I guess that guy is getting blasted into oblivion for this careless revelation of such a serious bug. Something akin to karma, perhaps.
This is a sobering reminder that nothing is ever completely safe or bug free. I assume there are plenty of Linux gamers who don't hang regularly on more hardcore sites where these things are normally featured.
Kudos to GoL for reporting on this. Awareness is half the battle.
I guess that guy is getting blasted into oblivion for this careless revelation of such a serious bug. Something akin to karma, perhaps.
5 Likes, Who?
Quoting: liamdaweI have cleaned up some comments and those that referenced the hateful comment.Last warning on this. Stop. Keep it on the topic.
GOL is an open community, if I see anyone again say inclusion is "cancer" they will get a hard ban.
7 Likes, Who?
As a security consultant myself, I can't believe it's 2019 and this guy didn't go through responsible disclosure. He'll get his 15 minutes of fame alright, but at the expense of his credibility for any future security work. I wouldn't touch this guy with a barge-pole, knowing that this is the attitude with which they approach their work.
14 Likes, Who?
It's really annoying to see people labelling themselves as security researchers, only to then go and do absolute asshole / blackhat stuff like publicly posting undisclosed issues or even actively attacking groups themselves.
No, if you attack people, or hand out undisclosed exploits to the people, then you're no longer a security researcher. At that point you've instead become a malicious actor, and a threat to the security community as a whole.
If people start thinking badly of security researchers because news sites and the like accept and propagate the labels idiots like this apply to themselves, then the entire security community is going to suffer.
No, if you attack people, or hand out undisclosed exploits to the people, then you're no longer a security researcher. At that point you've instead become a malicious actor, and a threat to the security community as a whole.
If people start thinking badly of security researchers because news sites and the like accept and propagate the labels idiots like this apply to themselves, then the entire security community is going to suffer.
8 Likes, Who?
slaapliedje Aug 7, 2019
The really dumb thing is that he could have still gotten good fame if he had just waited a regular time to announce it publicly after informing the KDE developers. Is this just within Dolphin, or a larger part of KDE as a whole? I don't normally use KDE, but was going to play with Project Trident on an old Macbook Pro, to see if I like FreeBSD, and was going to use KDE on it.
1 Likes, Who?
Quoting: scaineAs a security consultant myself, I can't believe it's 2019 and this guy didn't go through responsible disclosure. He'll get his 15 minutes of fame alright, but at the expense of his credibility for any future security work. I wouldn't touch this guy with a barge-pole, knowing that this is the attitude with which they approach their work.
Well, after CTS Labs vs AMD fiasco these behaviors doesn't surprise me anymore.
Not sure what happened that Liam had to suppress comments but this is just a security threat that any application can have (remember Shellshock). I hope that KDE is able to release a security patch ASAP in order to boycott the childish behavior of this guy.
3 Likes, Who?
Quoting: x_wingNot sure what happened that Liam had to suppress comments but this is just a security threat that any application can have (remember Shellshock).
It was completely unrelated to the topic, just someone ranting against diversity.
4 Likes, Who?
Patreon
PayPal
See more from me