KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2013-4132 from the MITRE CVE dictionary dictionary and NIST NVD.
Not Vulnerable. This issue does not affect the version of kdebase package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of kdebase-workspace package as shipped with Red Hat Enterprise Linux 6.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 1.9 |
|---|---|
| Base Metrics | AV:L/AC:M/Au:N/C:N/I:N/A:P |
| Access Vector | Local |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 7 | kde-workspace | Not affected |
| Red Hat Enterprise Linux 6 | kdebase-workspace | Not affected |
| Red Hat Enterprise Linux 5 | kdebase | Not affected |
Vulmon