Description
KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdenetwork | 4:2.2.2-14.7 | DSA-692-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kdenetwork +1 | 7:3.1.3-1.8 | RHSA-2005:175 |
Advisories 2
- RHSA-2005:175 Red Hat Security Advisory: kdenetwork security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-692-1 kppp - design flaw Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:9596 vdb-entry signature
- DSA-692 vendor-advisory
- RHSA-2005:175 vendor-advisory
- CLA-2005:934 vendor-advisory
- http://www.kde.org/info/security/advisory-20050228-1.txt
- 20050228 KPPP Privileged File Descriptor Leak Vulnerability third-party-advisory