January 20, 2006 11:44 AM PST
KDE flaws put Linux, Unix systems at risk
- Related Stories
-
Homeland Security helps secure open-source code
January 10, 2006 -
Apple opens up open-source effort
June 7, 2005 -
Major browsers bitten by security bugs
October 20, 2004
A serious vulnerability has been found in the popular KDE open-source software bundle. The flaw, deemed "critical" by the research outfit the French Security Incident Response Team, could allow a remote attacker to gain control over vulnerable systems. KDE is a desktop software package for Linux and Unix systems and includes the Konqueror Web browser and other applications.
The vulnerability lies in the JavaScript interpreter engine used by Konqueror and other parts of KDE, according to a security advisory posted Thursday. An attacker could craft a special UTF-8 encoded URI sequence to exploit the flaw, according to the advisory. For an attack to be successful, a person would have to visit the attacker's Web page using Konqueror, the FrSIRT said in its alert. Affected are KDE 3.2.0 up to and including KDE 3.5.0. Fixes are available.
Unix/Linux systems, which by employing user/process privileges reduce the attack surface considerably when compared to Windows which has a much larger attack surface due to flawed design, such as an integrated browser among others. Linux provides additional security features to reduce the attack surface with features such as LSM (Linux Security Module) and SELinux.
For example, if the same vulnerability was present in say I.E the attack surface would have been much greater than KDE due to the tight integration of I.E with Windows. In Linux this is much reduced due to the inherent security advantages of the Unix OS.
The next time you see a security alert about an OS, it helps to think about the attack surface it exposes. It gives a better sense of the actual vulnerability of the system to the flaw than an alarmist headline.
- Linux flaw(s)
-
by aqvanavt
January 24, 2006 7:01 AM PST
- I think people should realize that as Linux expands the more vunerable it will become to malicious hacking. Which is pretty weird considering that you can contribute to it's evolution with out being destructive.
-
Reply to this comment
-
-
See all 25 Comments >>