Bug 557525 - (CVE-2010-0285) CVE-2010-0285 gnome-screensaver insecurely unlocks screen when moving from one monitor to two
CVE-2010-0285 gnome-screensaver insecurely unlocks screen when moving from on...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://web.nvd.nist.gov/view/vuln/det...
impact=moderate,source=oss-security,r...
: Security
Depends On: 557795
Blocks:
  Show dependency treegraph
 
Reported: 2010-01-21 12:53 EST by Vincent Danen
Modified: 2015-07-31 02:23 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-05-19 02:08:22 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2010-01-21 12:53:12 EST
It was reported [1] that the GNOME screensaver could insecurely unlock a secondary screen when moving from a single screen display to a dual-screen display.  If a user were to have a suspended laptop, attach an external monitor, resume, and attempt to unlock the GNOME screensaver, the external display will show the GNOME desktop and can be interacted with, without requiring a password.

Upstream has provided a possible patch to correct the issue [2].

CVE-2010-0285 has been assigned to this issue.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=593616
[2] http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca
Comment 2 Josh Bressers 2010-01-21 15:29:01 EST
I'm scoring this as such:

cvss2=5.6/AV:L/AC:H/Au:N/C:C/I:C/A:N


Availability Impact is none, as we're talking about an instance here where either someone is sitting at an unused desk, or has stolen the machine (which CVSS2 doesn't really account for). The more likely of situations is a stolen computer. The attacker isn't affecting the availability of the machine, as it's currently not available for this attack to happen.
Comment 3 Josh Bressers 2010-01-21 16:07:55 EST
This doesn't affect Red Hat Enterprise Linux 3 or 4 as they don't contain gnome-screensaver.
Comment 4 Josh Bressers 2010-01-21 16:22:21 EST
I've been told this doesn't affect Red Hat Enterprise Linux 5 as the extend screen functionality doesn't work there. A second monitor can only be used as a mirror of the first.
Comment 8 Huzaifa S. Sidhpurwala 2011-05-19 02:08:22 EDT
Red Hat Enterprise Linux 4 does not contain gnome-screensaver. Red Hat Enterprise Linux 5 is not affected by this issue, and it is already fixed in Red Hat Enterprise Linux 6.

Statement:

Not vulnerable. This issue did not affect the versions of gnome-screensaver as
shipped with Red Hat Enterprise Linux 5 or 6.

Note You need to log in before you can comment on or make changes to this bug.