CVE-1999-1270: Medium severity KDE kde vulnerability
KMail in KDE 1.0 provides a PGP passphrase as a command line argument to other programs, which could allow local users to obtain the passphrase and compromise the PGP keys of other users by viewing the arguments via programs that list process information, such as ps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
KMail (KDE)from your environment.Uninstall or disable KMail on systems where it is not required to eliminate the risk of passphrase exposure.
- Configuration
Configure KMail to avoid supplying the user's PGP passphrase as a command-line argument to other programs; use an interactive prompt, secure IPC, or agent-based handling instead.
KMail (KDE) PGP passphrase on command line = disabled - Compensating control
Restrict local users' ability to view other users' process arguments (for example, restrict access to /proc/*/cmdline and limit use of ps-like utilities to trusted accounts) so passphrases passed on command lines cannot be exposed.
- Operational
If passphrase exposure is suspected, change the affected users' PGP passphrases and revoke/regenerate any compromised PGP keys.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1270?
CVE-1999-1270 is classified as a moderate severity vulnerability due to its potential to expose sensitive PGP passphrases to local users.
How do I fix CVE-1999-1270?
To mitigate CVE-1999-1270, update KMail to a version that does not pass the PGP passphrase as a command line argument or implement process access controls to restrict visibility of process information.
Who is affected by CVE-1999-1270?
Users of KMail version 1.0 are affected by CVE-1999-1270, particularly those utilizing PGP encryption.
What types of attacks can be executed due to CVE-1999-1270?
CVE-1999-1270 can allow local attackers to compromise PGP keys by accessing passphrases exposed through process listings.
What versions of KMail are vulnerable to CVE-1999-1270?
Only KMail version 1.0 is affected by CVE-1999-1270.