November 20, 2023
Severity Medium Analysis Summary Agent Tesla is a very popular spyware Trojan built for the.NET framework. Since its initial appearance in 2014, this has been deployed […]
Rewterz Threat Alert – LokiBot Gains New Persistence Mechanism, Uses Steganography to Hide Its Tracks
August 7, 2019Rewterz Threat Advisory – Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
August 7, 2019Rewterz Threat Alert – LokiBot Gains New Persistence Mechanism, Uses Steganography to Hide Its Tracks
August 7, 2019Rewterz Threat Advisory – Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
August 7, 2019
Severity
High
Analysis Summary
KDE is vulnerable to a command injection vulnerability in the KDesktopFile class. When a .desktop or .directory file is instantiated, it unsafely evaluates environment variables and shell expansions using KConfigPrivate::expandString() via the KConfigGroup::readEntry() function. Using a specially crafted .desktop file a remote user could be compromised by simply downloading and viewing the file in their file manager, or by drag and dropping a link of it into their documents or desktop.
Impact
Command injection
Affected Vendors
Linux
Affected Products
KDE version 4 and 5
Remediation
It is recommended for users to check any .desktop or .directory files and disable any dynamic entries.