Bug 557525 (CVE-2010-0285) - CVE-2010-0285 gnome-screensaver insecurely unlocks screen when moving from one monitor to two
Summary: CVE-2010-0285 gnome-screensaver insecurely unlocks screen when moving from on...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-0285
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard:
Depends On: 557795
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-01-21 17:53 UTC by Vincent Danen
Modified: 2021-02-25 01:48 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-05-19 06:08:22 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2010-01-21 17:53:12 UTC
It was reported [1] that the GNOME screensaver could insecurely unlock a secondary screen when moving from a single screen display to a dual-screen display.  If a user were to have a suspended laptop, attach an external monitor, resume, and attempt to unlock the GNOME screensaver, the external display will show the GNOME desktop and can be interacted with, without requiring a password.

Upstream has provided a possible patch to correct the issue [2].

CVE-2010-0285 has been assigned to this issue.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=593616
[2] http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca

Comment 2 Josh Bressers 2010-01-21 20:29:01 UTC
I'm scoring this as such:

cvss2=5.6/AV:L/AC:H/Au:N/C:C/I:C/A:N


Availability Impact is none, as we're talking about an instance here where either someone is sitting at an unused desk, or has stolen the machine (which CVSS2 doesn't really account for). The more likely of situations is a stolen computer. The attacker isn't affecting the availability of the machine, as it's currently not available for this attack to happen.

Comment 3 Josh Bressers 2010-01-21 21:07:55 UTC
This doesn't affect Red Hat Enterprise Linux 3 or 4 as they don't contain gnome-screensaver.

Comment 4 Josh Bressers 2010-01-21 21:22:21 UTC
I've been told this doesn't affect Red Hat Enterprise Linux 5 as the extend screen functionality doesn't work there. A second monitor can only be used as a mirror of the first.

Comment 8 Huzaifa S. Sidhpurwala 2011-05-19 06:08:22 UTC
Red Hat Enterprise Linux 4 does not contain gnome-screensaver. Red Hat Enterprise Linux 5 is not affected by this issue, and it is already fixed in Red Hat Enterprise Linux 6.

Statement:

Not vulnerable. This issue did not affect the versions of gnome-screensaver as
shipped with Red Hat Enterprise Linux 5 or 6.


Note You need to log in before you can comment on or make changes to this bug.