Description
KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdebase | 4:2.2.2-14.7 | DSA-388 |
Advisories 1
- DSA-388 kdebase - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- CLA-2003:747 vendor-advisory
- 20030916 [KDE SECURITY ADVISORY] KDM vulnerabilities mailing-list
- oval:org.mitre.oval:def:215 vdb-entry signature
- http://cert.uni-stuttgart.de/archive/suse/security/2002/12/msg00101.html
- RHSA-2003:270 vendor-advisory
- DSA-388 vendor-advisory
- MDKSA-2003:091 vendor-advisory
- http://www.kde.org/info/security/advisory-20030916-1.txt
- RHSA-2003:288 vendor-advisory