From owner-svn-ports-all@freebsd.org Sun Oct 4 05:49:10 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id D68693FB883; Sun, 4 Oct 2020 05:49:10 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C3t8Q5Mmzz4Glx; Sun, 4 Oct 2020 05:49:10 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 9AF941F169; Sun, 4 Oct 2020 05:49:10 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0945nA22039032; Sun, 4 Oct 2020 05:49:10 GMT (envelope-from tcberner@FreeBSD.org) Received: (from tcberner@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0945nAXP039031; Sun, 4 Oct 2020 05:49:10 GMT (envelope-from tcberner@FreeBSD.org) Message-Id: <202010040549.0945nAXP039031@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tcberner set sender to tcberner@FreeBSD.org using -f From: "Tobias C. Berner" Date: Sun, 4 Oct 2020 05:49:10 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r551354 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: tcberner X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 551354 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Oct 2020 05:49:10 -0000 Author: tcberner Date: Sun Oct 4 05:49:09 2020 New Revision: 551354 URL: https://svnweb.freebsd.org/changeset/ports/551354 Log: vuxml: document deskutils/kdeconnect-kde vulnerability KDE Project Security Advisory ============================= Title: KDE Connect: packet manipulation can be exploited in a Denial of Service attack Risk Rating: Important CVE: CVE-2020-26164 Versions: kdeconnect <= 20.08.1 Author: Albert Vaca Cintora Date: 2 October 2020 Overview ======== An attacker on your local network could send maliciously crafted packets to other hosts running kdeconnect on the network, causing them to use large amounts of CPU, memory or network connections, which could be used in a Denial of Service attack within the network. Impact ====== Computers that run kdeconnect are susceptible to DoS attacks from the local network. Workaround ========== We advise you to stop KDE Connect when on untrusted networks like those on airports or conferences. Since kdeconnect is dbus activated it is relatively hard to make sure it stays stopped so the brute force approach is to uninstall the kdeconnect package from your system and then run kquitapp5 kdeconnectd Just install the package again once you're back in a trusted network. Solution ======== KDE Connect 20.08.2 patches several code paths that could result in a DoS. You can apply these patches on top of 20.08.1: https://invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163 https://invent.kde.org/network/kdeconnect-kde/-/commit/b279c52101d3f7cc30a26086d58de0b5f1c547fa https://invent.kde.org/network/kdeconnect-kde/-/commit/d35b88c1b25fe13715f9170f18674d476ca9acdc https://invent.kde.org/network/kdeconnect-kde/-/commit/b496e66899e5bc9547b6537a7f44ab44dd0aaf38 https://invent.kde.org/network/kdeconnect-kde/-/commit/5310eae85dbdf92fba30375238a2481f2e34943e https://invent.kde.org/network/kdeconnect-kde/-/commit/721ba9faafb79aac73973410ee1dd3624ded97a5 https://invent.kde.org/network/kdeconnect-kde/-/commit/ae58b9dec49c809b85b5404cee17946116f8a706 https://invent.kde.org/network/kdeconnect-kde/-/commit/66c768aa9e7fba30b119c8b801efd49ed1270b0a https://invent.kde.org/network/kdeconnect-kde/-/commit/85b691e40f525e22ca5cc4ebe79c361d71d7dc05 https://invent.kde.org/network/kdeconnect-kde/-/commit/48180b46552d40729a36b7431e97bbe2b5379306 Credits ======= Thanks Matthias Gerstner and the openSUSE security team for reporting the issue. Thanks to Aleix Pol, Nicolas Fella and Albert Vaca Cintora for the patches. Security: CVE-2020-26164 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Oct 4 05:47:55 2020 (r551353) +++ head/security/vuxml/vuln.xml Sun Oct 4 05:49:09 2020 (r551354) @@ -58,6 +58,137 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + kdeconnect -- packet manipulation can be exploited in a Denial of Service attack + + + kdeconnect-kde + 20.08.1 + + + + +

Albert Astals Cid reports:

+
+

KDE Project Security Advisory

+ + + + + + + + + + + + + + + + + + + + + + + + + +
TitleKDE Connect: packet manipulation can be exploited in a Denial of Service attack
Risk RatingImportant
CVECVE-2020-26164
Versionskdeconnect <= 20.08.1
AuthorAlbert Vaca Cintora <albertvaka@gmail.com>
Date2 October 2020
+

Overview

+

+ An attacker on your local network could send maliciously crafted + packets to other hosts running kdeconnect on the network, causing + them to use large amounts of CPU, memory or network connections, + which could be used in a Denial of Service attack within the + network. +

+ +

Impact

+

+ Computers that run kdeconnect are susceptible to DoS attacks from + the local network. +

+ +

Workaround

+

+ We advise you to stop KDE Connect when on untrusted networks like + those on airports or conferences. +

+

+ Since kdeconnect is dbus activated it is relatively hard to make + sure it stays stopped so the brute force approach is to uninstall + the kdeconnect package from your system and then run +

+ 
+	      kquitapp5 kdeconnectd
+
+

+ Just install the package again once you're back in a trusted + network. +

+

Solution

+

+ KDE Connect 20.08.2 patches several code paths that could result + in a DoS. +

+

You can apply these patches on top of 20.08.1:

+
    +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163 +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/b279c52101d3f7cc30a26086d58de0b5f1c547fa +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/d35b88c1b25fe13715f9170f18674d476ca9acdc +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/b496e66899e5bc9547b6537a7f44ab44dd0aaf38 +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/5310eae85dbdf92fba30375238a2481f2e34943e +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/721ba9faafb79aac73973410ee1dd3624ded97a5 +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/ae58b9dec49c809b85b5404cee17946116f8a706 +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/66c768aa9e7fba30b119c8b801efd49ed1270b0a +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/85b691e40f525e22ca5cc4ebe79c361d71d7dc05 +
    • +
  • + https://invent.kde.org/network/kdeconnect-kde/-/commit/48180b46552d40729a36b7431e97bbe2b5379306 +
    • +
+

Credits

+

+ Thanks Matthias Gerstner and the openSUSE security team for + reporting the issue. +

+

+ Thanks to Aleix Pol, Nicolas Fella and Albert Vaca Cintora for the + patches. +

+
+ + + + https://kde.org/info/security/advisory-20201002-1.txt + CVE-2020-26164 + + + 2020-10-02 + 2020-10-04 + + + upnp -- denial of service (crash)