Bug 557525 (CVE-2010-0285)

Summary:	CVE-2010-0285 gnome-screensaver insecurely unlocks screen when moving from one monitor to two
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bressers, desktop-bugs, jmccann, rstrode
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0285
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-05-19 06:08:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	557795
Bug Blocks:

Description Vincent Danen 2010-01-21 17:53:12 UTC

It was reported [1] that the GNOME screensaver could insecurely unlock a secondary screen when moving from a single screen display to a dual-screen display.  If a user were to have a suspended laptop, attach an external monitor, resume, and attempt to unlock the GNOME screensaver, the external display will show the GNOME desktop and can be interacted with, without requiring a password.

Upstream has provided a possible patch to correct the issue [2].

CVE-2010-0285 has been assigned to this issue.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=593616
[2] http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca

Comment 2 Josh Bressers 2010-01-21 20:29:01 UTC

I'm scoring this as such:

cvss2=5.6/AV:L/AC:H/Au:N/C:C/I:C/A:N


Availability Impact is none, as we're talking about an instance here where either someone is sitting at an unused desk, or has stolen the machine (which CVSS2 doesn't really account for). The more likely of situations is a stolen computer. The attacker isn't affecting the availability of the machine, as it's currently not available for this attack to happen.

Comment 3 Josh Bressers 2010-01-21 21:07:55 UTC

This doesn't affect Red Hat Enterprise Linux 3 or 4 as they don't contain gnome-screensaver.

Comment 4 Josh Bressers 2010-01-21 21:22:21 UTC

I've been told this doesn't affect Red Hat Enterprise Linux 5 as the extend screen functionality doesn't work there. A second monitor can only be used as a mirror of the first.

Comment 8 Huzaifa S. Sidhpurwala 2011-05-19 06:08:22 UTC

Red Hat Enterprise Linux 4 does not contain gnome-screensaver. Red Hat Enterprise Linux 5 is not affected by this issue, and it is already fixed in Red Hat Enterprise Linux 6.

Statement:

Not vulnerable. This issue did not affect the versions of gnome-screensaver as
shipped with Red Hat Enterprise Linux 5 or 6.