PT-1998-1179 · Kde · Kmail+1

Publicado 1998-07-11 · Atualizado 2017-12-19 · CVE-1999-1270

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KDE versions 1.0

Description The issue allows local users to obtain a PGP passphrase and compromise PGP keys of other users. This is possible because KMail provides the PGP passphrase as a command line argument to other programs. Local users can view the arguments via programs that list process information, such as ps.

Recommendations For KDE version 1.0, consider modifying KMail to avoid passing the PGP passphrase as a command line argument to prevent it from being visible to other users. As a temporary workaround, restrict access to programs that list process information to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-1999-1270

Produtos afetados

Kde

Kmail

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-1999-1270 · Nota de Segurança
• http://lists.kde.org/?l=kde-devel&m=90221974029738&w=2 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/1639 · Nota