It was reported [1] that the GNOME screensaver could insecurely unlock a secondary screen when moving from a single screen display to a dual-screen display. If a user were to have a suspended laptop, attach an external monitor, resume, and attempt to unlock the GNOME screensaver, the external display will show the GNOME desktop and can be interacted with, without requiring a password. Upstream has provided a possible patch to correct the issue [2]. CVE-2010-0285 has been assigned to this issue. [1] https://bugzilla.gnome.org/show_bug.cgi?id=593616 [2] http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca
I'm scoring this as such: cvss2=5.6/AV:L/AC:H/Au:N/C:C/I:C/A:N Availability Impact is none, as we're talking about an instance here where either someone is sitting at an unused desk, or has stolen the machine (which CVSS2 doesn't really account for). The more likely of situations is a stolen computer. The attacker isn't affecting the availability of the machine, as it's currently not available for this attack to happen.
This doesn't affect Red Hat Enterprise Linux 3 or 4 as they don't contain gnome-screensaver.
I've been told this doesn't affect Red Hat Enterprise Linux 5 as the extend screen functionality doesn't work there. A second monitor can only be used as a mirror of the first.
Red Hat Enterprise Linux 4 does not contain gnome-screensaver. Red Hat Enterprise Linux 5 is not affected by this issue, and it is already fixed in Red Hat Enterprise Linux 6. Statement: Not vulnerable. This issue did not affect the versions of gnome-screensaver as shipped with Red Hat Enterprise Linux 5 or 6.