Test ID:	1.3.6.1.4.1.25623.1.0.51429
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2003:668
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory CLA-2003:668. KDE is a very popular graphical desktop environment available for GNU/Linux and other operating systems. In several cases, kde applications call the ghostview program to handle PS and PDF files in an insecure way (without the -DPARANOIDSAFER or -SAFER parameters), which may allow attackers to execute commands using crafted PS/PDF files[1,3]. Since these files can came from remote or untrusted sources (e-mail, web sites and network connections), remote attackers can exploit this vulnerability to execute arbitrary commands in the user's context using such sources as attack vectors. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2003-0204 to this issue[2]. Besides the fix for this vulnerability, the packages include other minor bugfixes incorporated in the KDE 3.1.2 version[4] and the fixes for the following problems reported in our bugzilla: - #8229: Problem to mount a CD-ROM as a normal user[5] - #8098: KDM default login is broken if KDE is not installed[6] - #8190: kmplayer is the default player for all multimedia files[7]. * User of Conectiva Linux 7.0 and 8 are also exposed to this vulnerability and can expect updated packages to be provided soon. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.kde.org/info/security/advisory-20030409-1.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0204 http://bugzilla.conectiva.com.br/show_bug.cgi?id=8772 http://www.kde.org/announcements/changelogs/changelog3_1_1to3_1_2.php http://bugzilla.conectiva.com.br/show_bug.cgi?id=8229 http://bugzilla.conectiva.com.br/show_bug.cgi?id=8098 http://bugzilla.conectiva.com.br/show_bug.cgi?id=8190 http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:668 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0204 Bugtraq: 20030410 GLSA: kde-3.x (200304-04) (Google Search) http://marc.info/?l=bugtraq&m=105001557020141&w=2 Bugtraq: 20030411 GLSA: kde-2.x (200304-05) (Google Search) http://marc.info/?l=bugtraq&m=105012994719099&w=2 Bugtraq: 20030412 [Sorcerer-spells] KDE-SORCERER2003-04-12 (Google Search) http://marc.info/?l=bugtraq&m=105017403010459&w=2 Bugtraq: 20030414 GLSA: kde-2.x (200304-05.1) (Google Search) http://marc.info/?l=bugtraq&m=105034222521369&w=2 Conectiva Linux advisory: CLA-2003:668 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000668 Conectiva Linux advisory: CLA-2003:747 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747 Debian Security Information: DSA-284 (Google Search) http://www.debian.org/security/2003/dsa-284 Debian Security Information: DSA-293 (Google Search) http://www.debian.org/security/2003/dsa-293 Debian Security Information: DSA-296 (Google Search) http://www.debian.org/security/2003/dsa-296 http://www.mandriva.com/security/advisories?name=MDKSA-2003:049 http://www.redhat.com/support/errata/RHSA-2003-002.html
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.