privilage escalation in clock kcontrol

to be made public on 6th November
I have a vivid package ready to upload

Thanks for the patches. Unfortunately, due to bug #1047417, precise has been updated with 4.8.5 and so much of kde needs to be rebuilt against the security pocket for this security update.

(meaning, the update will be delayed)

Ah, it appears only kdepimlibs needs a no change rebuild (we already updated other bits in the security ppa previously).

Precise FTBFS:
../../../kcontrol/dateandtime/helper.cpp: In function 'QString findNtpUtility()':
../../../kcontrol/dateandtime/helper.cpp:54:80: error: 'exePath' was not declared in this scope
make[5]: *** [kcontrol/dateandtime/CMakeFiles/kcmdatetimehelper.dir/helper.o] Error 1
make[5]: Leaving directory `/«PKGBUILDDIR»/obj-x86_64-linux-gnu'
make[4]: *** [kcontrol/dateandtime/CMakeFiles/kcmdatetimehelper.dir/all] Error 2
make[4]: *** Waiting for unfinished jobs....

is this patch from upstream?

What is happening is that kcontrol/dateandtime/helper.cpp is missing:
// We cannot rely on the $PATH environment variable, because D-Bus activation
// clears it. So we have to use a reasonable default.
static const QString exePath = QLatin1String("/usr/sbin:/usr/bin:/sbin:/bin");

This was apparently added in a previous commit. Jonathon, can you confirm that adding the above to the patch is all that is needed?

(sorry, I of course meant Jonathan).

Upstream patch gone public, debdiffs updated with final version
https://www.kde.org/info/security/advisory-20141106-1.txt

FYI, the updated precise patch looks like it will still FTBFS in dateandtime/helper.cpp. Have you built and tested these locally?

FYI, updating the updated patch and also using exePath with findExe() for hwclock and zic like on 4.11.

This is now allocated CVE-2014-8651

building locally now..

This bug was fixed in the package kde-workspace - 4:4.8.5-0ubuntu0.4

---------------
kde-workspace (4:4.8.5-0ubuntu0.4) precise-security; urgency=medium

  [ Jonathan Riddell ]
  * SECURITY UPDATE: Privilege Escalation via KDE Clock KCM polkit helper
   - Add upstream_clock-privilage-escalation.diff, checks which
     binary is being run
   - https://www.kde.org/info/security/advisory-20141106-1.txt
   - LP: #1389665

  [ Jamie Strandboge ]
  * update upstream_clock-privilage-escalation.diff to add exePath definition
    to fix a FTBFS, and also use exePath with hwclock and zic, like on newer
    releases
 -- Jamie Strandboge <email address hidden> Thu, 06 Nov 2014 14:22:00 -0600

This bug was fixed in the package kde-workspace - 4:4.11.12-0ubuntu1.1

---------------
kde-workspace (4:4.11.12-0ubuntu1.1) utopic-security; urgency=medium

  * SECURITY UPDATE: Privilege Escalation via KDE Clock KCM polkit helper
   - Add upstream_clock-privilage-escalation.diff, checks which
     binary is being run
   - https://www.kde.org/info/security/advisory-20141106-1.txt
   - LP: #1389665
 -- Jonathan Riddell <email address hidden> Wed, 05 Nov 2014 13:10:05 +0100

This bug was fixed in the package kde-workspace - 4:4.11.11-0ubuntu0.2

---------------
kde-workspace (4:4.11.11-0ubuntu0.2) trusty-security; urgency=medium

  * SECURITY UPDATE: Privilege Escalation via KDE Clock KCM polkit helper
   - Add upstream_clock-privilage-escalation.diff, checks which
     binary is being run
   - https://www.kde.org/info/security/advisory-20141106-1.txt
   - LP: #1389665
 -- Jonathan Riddell <email address hidden> Wed, 05 Nov 2014 13:14:49 +0100