CVE-2004-1171

KDE 3.2.x-3.3.2 - Unprotected Credential Exposure via Plaintext Storage in .desktop Files

Title source: llm

Description

KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to obtain usernames and passwords for remote resources such as SMB shares.

References (16)

Core 16

Core References

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/305294

Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/11866

Third Party Advisory, US Government Resource third-party-advisory government-resource x_refsource_ciac

http://www.ciac.org/ciac/bulletins/p-051.shtml

Third Party Advisory mailing-list x_refsource_fulldisc

http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1292.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/18267

Vendor Advisory vendor-advisory x_refsource_mandrake

http://www.mandriva.com/security/advisories?name=MDKSA-2004:150

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/13486

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1012471

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/13560

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=110261063201488&w=2

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/12248

Various Sources x_refsource_misc

http://www.sec-consult.com/index.php?id=118

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200412-16.xml

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=110178786809694&w=2

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/13477

Various Sources x_refsource_confirm

http://www.kde.org/info/security/advisory-20041209-1.txt

Scores

EPSS 0.0013

EPSS Percentile 31.2%

Details

Status published

Products (11)

kde/kde 3.2

kde/kde 3.2.1

kde/kde 3.2.2

kde/kde 3.2.3

kde/kde 3.3

kde/kde 3.3.1

kde/kde 3.3.2

mandrakesoft/mandrake_linux 10.0 (2 CPE variants)

mandrakesoft/mandrake_linux 10.1 (2 CPE variants)

redhat/fedora_core core_2.0

... and 1 more

Published Jan 10, 2005

Tracked Since Feb 18, 2026