Easy Online Tips

Tuesday, January 24, 2006

KDE kjs UTF-8 Encoded URI Buffer Overflow Vulnerability

Maksim Orlovich has reported a vulnerability in KDE kjs, which can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a user's system.

KDE or the K Desktop Environment allows for easy navigation with the aid of the K File Manager, Virtual Desktops and use of KDE-based applications like K-Edit. Currently, installed by default on many Linux distributions with notable exceptions of RedHat (GNOME) and Debian (Window Maker).

The vulnerability is caused due to a boundary error in kjs in the decoding of UTF-8 encoded URI sequences. This can be exploited to cause a heap-based buffer overflow by supplying specially crafted JavaScript code via an application using the affected JavaScript interpreter engine (e.g. Konqueror).

Successful exploitation allows execution of arbitrary code.

The vulnerability has been reported in versions 3.2.0 through 3.5.0.

Apply patches.

KDE 3.4.0 - 3.5.0:

KDE 3.2.0 - 3.3.2:

Provided and/or discovered by:
Maksim Orlovich

Original Advisory:


Post a Comment

Back to Online Tips