bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

KDE Linux desktop: security hole in Ark allowed remote attacks

Summary

In 2020 the KDE archive manager Ark contained a path traversal hole (CVE-2020-16116) through which prepared archives could write files to arbitrary locations in the home directory. This could be used, for example, to place a manipulated .bashrc or a script in the autostart folder, but the user had to extract the archive. Ark 20.08.0 prevented this and also issued a warning.

Ideas

  • Paths with “../” in archives can break out of the target directory.
  • Files such as .bashrc or autostart entries execute code at the next login.
  • A proof of concept was already available on GitHub.
  • heise corrected its original classification as a remote attack.

Insights

  • Extracting is a write operation with foreign file names and needs the same care as code execution.
  • Persistence via configuration files in the home directory is an underestimated attack path.

Facts

  • Ark versions up to 20.04.3 were vulnerable.
  • Besides 20.08.0, KDE offered a patch for older versions.

References

Critique

  • The report had to be corrected afterwards because it initially classified the attack vector incorrectly as a remote attack.

Recommendations

  • Extract archives of unknown origin only after listing their contents and checking the paths.
  • Use tools that reject paths outside the target directory.

Read the original article

Search the Web Archive

hß · 2018

Updates close 19-year-old security hole in remote tool OpenSSH

In 2018 Qualys reported a hole in OpenSSH (CVE-2018-15473) that had existed since the first version in 1999. With prepared packets, attackers could check remotely whether a user name exists, because the server ended the connection differently for valid names. The hole was not considered critical but provided material for targeted password attacks.

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2014

AVM routers: another hole in the FritzBox remote maintenance function

In 2014 heise Security found a hole in the MyFritz apps for Android and iOS through which attackers could access a FritzBox’s web interface without a password. The apps did not check the box’s SSL certificate sufficiently, so an attacker on someone else’s network could grab the session ID. AVM solved this with certificate pinning: the apps remember the certificate’s fingerprint on first contact and warn if it changes.