PT-2013-4865 · Gnu+2 · Glibc+2

Mancha · Published 2013-09-01 · Updated 2018-10-30 · CVE-2013-4132

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions KDE-Workspace versions 4.10.5 and earlier

Description The issue arises from improper handling of the return value of the glibc 2.17 crypt and pw encrypt functions. This allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and crash. The attack can be initiated via an invalid salt or a DES or MD5 encrypted password when FIPS-140 is enabled, targeting KDM, or through an invalid password to KCheckPass.

Recommendations For KDE-Workspace versions 4.10.5 and earlier, consider updating to a version that properly handles the return value of the glibc crypt and pw encrypt functions to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-4132

MGASA-2013-0269

SUSE-SU-2014_0885-1

Affected Products

Kde-Workspace

Suse

Glibc

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2013-4132 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00082.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00002.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0269.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4133 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4132 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0269 · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4133 · Note
• https://bugzilla.novell.com/829857 · Note
• http://support.novell.com/security/cve/CVE-2013-4133.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=10600 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2014-July/000907.html · Note
• http://support.novell.com/security/cve/CVE-2013-4132.html · Note
• http://seclists.org/oss-sec/2013/q3/120 · Note