Information disclosure in KWallet

1) Symlink attack

EUVDB-ID: #VU12586

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-10380

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists in the kwallet-pam module due to improper security restrictions, performing file writing and permission changing operations as root. A local attacker can conduct symbolic link attack and gain access to potentially sensitive information.

Mitigation

Update to version 5.12.6 or 5.13.0.

Vulnerable software versions

KWallet: 5.9 - 5.12.5

CPE2.3

• cpe:2.3:a:kde_org:kwallet:5.9:*:*:*:*:*:*:*
• cpe:2.3:a:kde_org:kwallet:5.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:kde_org:kwallet:5.9.2:*:*:*:*:*:*:*

External links

https://www.kde.org/info/security/advisory-20180503-1.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.