CVE-2000-0393: High severity KDE kde vulnerability
The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, which allows the user to gain privileges by specifying an alternate program to execute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure kscd does not use the user's SHELL environment variable when executing programs; clear or set SHELL to a safe known value in kscd's environment before any exec.
kscd (KDE kscd) SHELL environment handling = ignore or sanitize user-provided SHELL - Configuration
Modify kscd so it drops elevated privileges (relinquish any privileged UID/GID) before executing any program specified by the user.
kscd (KDE kscd) privilege dropping = drop privileges before executing external programs - Compensating control
Until a vendor-supplied fix is available, restrict access to the kscd binary to trusted administrative accounts (use filesystem permissions/ownership or other access controls) to prevent unprivileged users from invoking kscd.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0393?
CVE-2000-0393 has been assessed as a high severity vulnerability due to the potential privilege escalation it allows.
How do I fix CVE-2000-0393?
To fix CVE-2000-0393, it is recommended to upgrade to a version of KDE that implements proper privilege management.
What systems are affected by CVE-2000-0393?
CVE-2000-0393 affects KDE versions 1.1, 1.1.1, 1.2, and 2.0_beta.
What type of vulnerability is CVE-2000-0393?
CVE-2000-0393 is classified as a privilege escalation vulnerability.
Who is impacted by CVE-2000-0393?
Users running the affected versions of KDE are at risk of privilege escalation attacks through the kscd program.