[转载]Cleartext SMB Passwords in Novell Desktop Linux using KDE

信息来源：www.securiteam.com

Details
Systems affected:
Novell Desktop Linux 9 when using KDE (release 3.2.1). Other distributions with KDE may be affected as well. Mike couldn't reproduce this on Fedora Core 3. Mike tried performing the same action on Novell Desktop Linux 9 with Gnome, but the GUI wouldn't let me create a symbolic link to a shared file/folder. Mike is ot sure if other distributions are affected.

Temporary workaround:
Don't create symbolic links to networked files and folders if using KDE. The correct thing for the system to do is not put the username and password information in the filename, meta data or URL field. These should either be stored in an encrypted key repository (like Apple's Keychain) or requested every time the user accesses the network share.

Vendor status:
Contact with Novell occurred on November 16, 2004. Vendor claims a fix should be out soon.

Exploit:
When creating a symbolic link to a file or folder located on a SMB network share using KDE, the user's name and password are displayed in clear text on the desktop. The login name and password are also in the link file's meta data in addition to the actual filename itself.

Steps to perform the exploit:
* Install NLD with KDE (either default to KDE or choose to install both KDE and Gnome)
* Log in via KDE
* Open Network Browser
* Open Windows Network
* Find an SMB Windows share
* Authenticate to the share
* Left click on a file or folder, drag it to the desktop, select "Link Here"
* A file will be created on the desktop

File name is:
smb://username:password@server/path/to/file

It puts the username and password both in clear text on the desktop, in plain site of everyone. These also appear in the URL and Meta Info property location. When Mike tried doing that in Gnome, Mike got a message "Error 'Unsupported operation' while creating a link to smb://server/path/to/file" and it doesn't create the link.

Additional information
The information has been provided by Mike DeMaria.