KDE 3.0.x - KPF Icon Option File Disclosure

Author: Ajay R Ramjatan
type: remote
platform: linux
port: 
date_added: 2002-10-11 
date_updated: 2012-10-13 
verified: 1 
codes: CVE-2002-1224;OSVDB-8945 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5951/info

A vulnerability has been discovered in the kpf file sharing utility. KDE is available for the Linux operating system.

It has been reported that by passing a malicious file request to kpf, it is possible for a remote attacker to access files outside of the 'shared directory' root. The ability to read files outside of the shared root directory would be dependent upon the privileges of the kpf process.

http://127.0.0.1:8001/?icon=/usr/local/kde/share/icons/hicolor/32x32/mimetypes/image.png