PT-1998-1179 · Kde · Kmail+1

Published 1998-07-11 · Updated 2017-12-19 · CVE-1999-1270

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KDE versions 1.0

Description The issue allows local users to obtain a PGP passphrase and compromise PGP keys of other users. This is possible because KMail provides the PGP passphrase as a command line argument to other programs. Local users can view the arguments via programs that list process information, such as ps.

Recommendations For KDE version 1.0, consider modifying KMail to avoid passing the PGP passphrase as a command line argument to prevent it from being visible to other users. As a temporary workaround, restrict access to programs that list process information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1270

Affected Products

Kde

Kmail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-1999-1270 · Security Note
• http://lists.kde.org/?l=kde-devel&m=90221974029738&w=2 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/1639 · Note