KDE Project Security Advisory: ktnef: Directory Traversal

[Philip Muškovac]

KDE Project Security Advisory
=============================

Title: ktnef: Directory Traversal
Risk Rating: Medium
CVE: TBC
Versions: ktnef <= 5.4.2 (KDE Applications 16.12.2)
Date: 27 February 2017

Overview
========
A directory traversal issue was found in ktnef which can
be exploited by tricking a user into opening a malicious winmail.dat file.
The issue allows to write files with the permission of the user opening
the winmail.dat file during extraction.

Solution
========
Update to ktnef >= 5.4.3 (KDE Applications 16.12.3) (when released)

Or apply the following patch:
https://commits.kde.org/ktnef/4ff38aa15487d69021aacad4b078500f77fb4ae8

[vishnunaini (visred)]

debdiff for yakkety is included in the attachment.

[vishnunaini (visred)]

Xenial is in kdepim not ktnef.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiff in comment #1, I've uploaded packages for building to yakkety and zesty with a slight changelog whitespace and pocket change. The yakkety package will be published as a security update as soon as it's built. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package ktnef - 4:16.04.3-0ubuntu2

---------------
ktnef (4:16.04.3-0ubuntu2) zesty; urgency=medium

  * SECURITY UPDATE: Malicious writes during directory traversal.
      - debian/patches/directory-traversal.patch
      - Thanks to Eric Sesterhenn for reporting this issue, Albert Astals
        Cid for fixing this issue.
      - No CVE number.
      - fixes (LP: #1668552)

 -- <email address hidden> (v.naini) Wed, 01 Mar 2017 13:53:49 +0530

[Philip Muškovac (yofel)]

Ktnef exists in xenial and should be affected the same. As for kdepim, I made a mistake when looking at the contents. The code is rather different, so if the old ktnef from kdepim is affected then this is relevant for trusty *and* xenial, not just trusty.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ktnef - 4:16.04.3-0ubuntu1.1

---------------
ktnef (4:16.04.3-0ubuntu1.1) yakkety-security; urgency=medium

  * SECURITY UPDATE: Malicious writes during directory traversal.
      - debian/patches/directory-traversal.patch
      - Thanks to Eric Sesterhenn for reporting this issue, Albert Astals
        Cid for fixing this issue.
      - No CVE number.
      - fixes (LP: #1668552)

 -- <email address hidden> (v.naini) Wed, 01 Mar 2017 13:53:49 +0530

[vishnunaini (visred)]

debdiff for ktnef in xenial is attached.

kdepim also needs to patched both in xenial and trusty.

[vishnunaini (visred)]

I cannot make debdiffs' for kdepim as I am not sure if the patch is compatible. Someone familiar with the code should patch it.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ktnef - 4:15.12.3-0ubuntu1.1

---------------
ktnef (4:15.12.3-0ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Malicious writes during directory traversal.
      - debian/patches/directory-traversal.patch
      - Thanks to Eric Sesterhenn for reporting this issue, Albert Astals
        Cid for fixing this issue.
      - No CVE number.
      - fixes (LP: #1668552)

 -- <email address hidden> (v.naini) Thu, 02 Mar 2017 20:58:12 +0530

[Marc Deslauriers (mdeslaur)]

Since there is nothing left to sponsor, I am unsubscribing ubuntu-security-sponsors. Please re-subscribe the group when attaching another debdiff. Thanks!