CVE-2004-1171

KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for plaintext in the users .desktop file, which may be created with world-readable permissions, which could allow local users to obtain usernames and passwords for remote resources such as SMB shares.

Affected Software

Name	Vendor	Start Version	End Version
Kde	Kde	3.2 (including)	3.2 (including)
Kde	Kde	3.2.1 (including)	3.2.1 (including)
Kde	Kde	3.2.2 (including)	3.2.2 (including)
Kde	Kde	3.2.3 (including)	3.2.3 (including)
Kde	Kde	3.3 (including)	3.3 (including)
Kde	Kde	3.3.1 (including)	3.3.1 (including)
Kde	Kde	3.3.2 (including)	3.3.2 (including)
Mandrake_linux	Mandrakesoft	10.0 (including)	10.0 (including)
Mandrake_linux	Mandrakesoft	10.1 (including)	10.1 (including)
Fedora_core	Redhat	core_2.0 (including)	core_2.0 (including)
Fedora_core	Redhat	core_3.0 (including)	core_3.0 (including)
Kdebase	Ubuntu	dapper	*
Kdebase	Ubuntu	devel	*
Kdebase	Ubuntu	edgy	*
Kdebase	Ubuntu	feisty	*
Kdelibs	Ubuntu	dapper	*
Kdelibs	Ubuntu	devel	*
Kdelibs	Ubuntu	edgy	*
Kdelibs	Ubuntu	feisty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2004-1171
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References