Here's your morning dose of uh-oh, a security researcher has made an unfortunate vulnerability in KDE public. Not something we usually cover, but since there's no fix available it's worth letting you know.
The issue relates to how KDE handles .desktop and .directory files, since on KDE they allow what they call "Shell Expansion" allowing some nasty code to be run. The other issue, is that KDE will automatically execute them without you even opening the files. Discovered by Dominik "zer0pwn" Penner, you can see their write-up of the issue here:
Using a specially crafted .desktop file a remote user could be compromised by simply downloading and viewing the file in their file manager, or by drag and dropping a link of it into their documents or desktop.
Sadly, this makes the security issue one that's quite easy for someone to exploit, as long as they get you to download something containing the malicious file.
On Twitter, the KDE team posted:
For the moment avoid downloading .desktop or .directory files and extracting archives from untrusted sources.
However, that might not be good enough. Going by what else Penner also said on Twitter, it's not just .desktop or .directory files as any unknown filetype can be detected by KDE as an application/desktop mimetype making it a lot worse than originally thought. As long as a file contains "[Desktop Entry]" at the top, it seems KDE will have a go at parsing it.
On top of that, the KDE team were not made aware of the issue before this was all made public. So if you're running KDE, time to be super careful until a patch is out. Hopefully all distributions shipping KDE will be keeping a close eye on this for when a patch is available.
Article taken from GamingOnLinux.com.
Some you may have missed, popular articles from the last month:
The comments on this article are closed.
Quoting: constHis name is kind of fitting. Penner is a foul name in german. It used to be used similar to english "hobo", but now pretty much means "jerk".
Was about to write this - ironic that the name is so fitting for someone that posts such a serious attack vector without responsible disclosure pratices....
0 Likes
Hmh, not a bug, a design flaw. Things like that happen, they implemented some requirement for running shell extensions and forgot the possible security implication if it runs unnoticed.
I remember a similar discussion by the KDE team actually in another topic, where they caught that thing before they released it and changed it before.
Things like that happen, and it will be fixed in no time, of that I'm sure.
I remember a similar discussion by the KDE team actually in another topic, where they caught that thing before they released it and changed it before.
Things like that happen, and it will be fixed in no time, of that I'm sure.
1 Likes, Who?
slaapliedje Aug 7, 2019
Quoting: chancho_zombieso it doesn't affect KDE 3 time to give Trinity Desktop a spin.Whoa, is that still maintained? Kind of think it'd be cool to run on top of FreeBSD that I'm planning on putting on an old Macbook.
0 Likes
Quoting: HoriThe problem is not the goal (clean code) the problem is how you go about achieving it. If you introduce bugs in the process, it's obviously bad.
When you go about refactoring code, you must be absolutely sure you know what you're doing, that what you aim to achieve is actually helpful and of good design, and that both the old code and the new code are properly covered by unit tests and/or automation tests so that you can proceed with a high degree of confidence that as long as the tests pass, what you change won't cause any regression, and in the outstanding case that it does, it should be caught by manual testing.
Exactly. Clean code isn't a bad goal, but if you rewrite instead of refactor and cleaning up there is a high chance to you introduce a huge number of new problems. There is a huge number of articles on the net (and in the literature) that deal with this topic. Writing good tests is hard. Complete manual tests are tedious, so in most cases there is only minimal testing and that is done in a way to check the intended changes.
Take the Konsole regression. The intention of the change was to make the code prettier and the UI sleeker at the same time by disabling changing the icon unless the tab uses a custom icon. Obviously after the bell (temporary custom icon) has been cleared the tab switches back to the default icon, so it is never set.
TL;DR: And there is a difference between refactoring something and rewriting it without a compelling reason. Often the thing that you want to get rid of because it looks like cruft is necessary to handle edge cases.
0 Likes
Projectile Vomit Aug 7, 2019
Well, this does suck. :(
0 Likes
I'm using Manjaro with KDE Plasma, but since I'm not in the habit of downloading, installing or executing random files, I still feel pretty safe.
I've also been using Windows since many, many years without any kind of antivirus software and never had any problems whatsoever.
Frankly, nothing is ever entirely safe. And the biggest safety risk is not some software vulnerability sitting hidden behind some execution layers, but something entirely different sitting in front of the monitor...
Last edited by TheSHEEEP on 7 August 2019 at 4:47 pm UTC
I've also been using Windows since many, many years without any kind of antivirus software and never had any problems whatsoever.
Frankly, nothing is ever entirely safe. And the biggest safety risk is not some software vulnerability sitting hidden behind some execution layers, but something entirely different sitting in front of the monitor...
Last edited by TheSHEEEP on 7 August 2019 at 4:47 pm UTC
8 Likes, Who?
FurbyOnSteroid Aug 7, 2019
Thanks for the heads-up.
Considering that I very rarely install anything, I think I will be just fine. Still, this needs to be fixed asap!
The guy that found it, nice but he really has to handle those things the right way. I'm certain he knows how to handle it correctly, but he just doesn't care. According to his twitter he is a "whitehat wizard" while sharing basically a tutorial on how to do it on one of kde's replies. I'm sorry but that's just.. I have many words and yet, I won't post any because I don't want this comment to be removed. Very untrustworthy and disqualifies him immediately as a "whitehat". Should be ashamed of his actions just to be "the cool kid".
Considering that I very rarely install anything, I think I will be just fine. Still, this needs to be fixed asap!
The guy that found it, nice but he really has to handle those things the right way. I'm certain he knows how to handle it correctly, but he just doesn't care. According to his twitter he is a "whitehat wizard" while sharing basically a tutorial on how to do it on one of kde's replies. I'm sorry but that's just.. I have many words and yet, I won't post any because I don't want this comment to be removed. Very untrustworthy and disqualifies him immediately as a "whitehat". Should be ashamed of his actions just to be "the cool kid".
1 Likes, Who?
Quoting: TheSHEEEPFrankly, nothing is ever entirely safe. And the biggest safety risk is not some software vulnerability sitting hidden behind some execution layers, but something entirely different sitting in front of the monitor...
I always knew my cats were up to no good!
10 Likes, Who?
Isn't there some way to disable automatic launching for such files? Autoruns is such an old nasty issue, that it's surprising KDE still has it enabled by default.
Last edited by Shmerl on 7 August 2019 at 7:10 pm UTC
Last edited by Shmerl on 7 August 2019 at 7:10 pm UTC
1 Likes, Who?
eridanired123 Aug 7, 2019
There is a patch for this already, going trough QA atm: https://www.reddit.com/r/kde/comments/cmsjgd/unpatched_kde_vulnerability_disclosed_on_twitter/ew4npbu/
5 Likes, Who?
TheRiddick Aug 8, 2019
Quoting: ElectricPrismSo if you are one of those people this is for you:
Haha!
I always found it the other way around, gnome users talking about how fantastic their featureless (most extensions don't work) desktop is and how KDE is bloatware, meanwhile I moved from GNOME to PLASMA5 the other day and noticed things just work allot better and faster (even games work faster somehow).
Shrug.. Just saying. GNOME SUCKS!
1 Likes, Who?
Ari El Uno Aug 8, 2019
Quoting: Stupendous ManWhy didn't they notify the KDE team BEFORE publishing their write-up? That's what responsible disclosure is all about, and would have avoided this situation! Give the team a couple months to patch, and THEN make the write-up.They have to fix it ASAP, not a couple of MONTHS.
I'm a bug bounty hunter myself and any ethical hacker knows not to just disclose a bug to the world as soon as you find it. Pathetic.
0 Likes
Quoting: DragunovGood thing I use Gnome/Cinnamon :P
Gnome just had malware use the extensions. At the very least, this plasma issue most likely hasn't been utilized in the wild.
That said, nothing is perfect, and there will always be security issues of some kind. It's why Linus Torvalds doesn't consider security issues any more important than bugs.
1 Likes, Who?
Stupendous Man Aug 8, 2019
Quoting: Ari El UnoThey have to fix it ASAP, not a couple of MONTHS.Depends on the severity of the bug. Remember, if the hacker informs the company privately, ideally only the hacker and the company know of the vulnerability. But yeah, the sooner the better.
It is also normal procedure to ask before disclosing, no matter how long time has passed.
2 Likes, Who?
QuoteFor the moment avoid downloading .desktop or .directory files and extracting archives from untrusted sources.
It's not windows, nobody downloads software off the internet already
2 Likes, Who?
Quoting: ShmerlIsn't there some way to disable automatic launching for such files? Autoruns is such an old nasty issue, that it's surprising KDE still has it enabled by default.
It's not autorun per say, it's more like KDE can execute some scripts from the .desktop file e.g in order to determine what to display as the title if you hover over it (not 100% sure since I'm basing this on reading from the KDE site for a few seconds).
Which of course in practice turns it into autorun, but since that was never the intended purpose there is not a way to disable the feature. If the KDE devs had understood that they had actually implemented autorun I'm sure that they would not have implemented this at all. Some one with lots of time on their hand could hunt over their bugzilla and see when this feature was implemented and why, high chance is that it was due to some feature request/bug-report.
0 Likes
slaapliedje Aug 10, 2019
Quoting: TheRiddickGuess it depends on your use case. Me, I want something that's just there to launch applications, after all, that's what you use, right? You don't use the operating system, it's just there to manage your applications and windows.Quoting: ElectricPrismSo if you are one of those people this is for you:
Haha!
I always found it the other way around, gnome users talking about how fantastic their featureless (most extensions don't work) desktop is and how KDE is bloatware, meanwhile I moved from GNOME to PLASMA5 the other day and noticed things just work allot better and faster (even games work faster somehow).
Shrug.. Just saying. GNOME SUCKS!
For me, Windows, Mac OSX and KDE seem to get more in the way than they need to. I'll say Windows Sucks for stability, privacy, etc. but not going to really say KDE sucks (well macOS I just don't see a need for :P).
Back on topic, this seems like a terrible implementation of just showing an icon and the title, which .desktop already does, why is it executing anything?
0 Likes
The update that fixes this is now available according to Phoronix
3 Likes, Who?
Patreon
PayPal
See more from me