CVE-2011-1586: Path Traversal
Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.
Other sources
Ubuntu has noticed that the patch used to fix CVE-2010-1000 was incomplete [1]. It would fix things like ../../tmp/foo but did not catch a single leading ../ (such as ../foo/bar). https://bugs.launchpad.net/ubuntu/+source/kdenetwork/+bug/757526
These patches from upstream fully fix it:
http://websvn.kde.org/branches/KDE/4.4/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227468&r2=1227467&pathrev=1227468&view=patch http://websvn.kde.org/branches/KDE/4.5/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227469&r2=1227468&pathrev=1227469&view=patch
[1] https://bugs.launchpad.net/ubuntu/+source/kdenetwork/+bug/757526
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1586?
The severity of CVE-2011-1586 is rated as medium due to its potential for exploitation through directory traversal.
How do I fix CVE-2011-1586?
To fix CVE-2011-1586, upgrade to a patched version of KDE SC that addresses the directory traversal vulnerability.
What versions of KDE SC are affected by CVE-2011-1586?
KDE SC versions up to and including 4.6.2 are affected by CVE-2011-1586.
What exploit does CVE-2011-1586 contain?
CVE-2011-1586 contains a directory traversal vulnerability that allows remote attackers to create arbitrary files.
What functions are involved in the CVE-2011-1586 vulnerability?
The KGetMetalink::File::isValidNameAttr function in metalinker.cpp is the primary function involved in the CVE-2011-1586 vulnerability.