gnome-screensaver can lose its keyboard grab when locked, exposing the system to intrusion by adding and removing monitors.
This issue is similar to but different than bug 609337 (CVE-2010-0414)
Steps to reproduce:
1) Lock screen
2) Plug in new monitor and wait for unlock dialog to show on it.
3) Unplug new monitor, watch unlock dialog move to primary monitor
4) Replug new monitor, watch unlock dialog stay on primary monitor
5) Unplug new monitor
6) hit alt-f2 and type "pkill -f gnome-screensaver"
Created attachment 390573 [details]
patch to fix the problem
As with the other similar issue, this one only affects gnome-screensaver 2.28, so only Fedora 12 is affected.
Please use CVE-2010-0422 for this issue.
Fixes are upstream here:
Wow, gnome-screensaver's hold on the X session is more fragile than I would have expected. It makes me wish the X server would give us more help securely locking the screen and perhaps keeping it locked even if gnome-screensaver crashes ("fail-secure").
gnome-screensaver-2.28.3-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
This problem is still not fixed for me. I am using the latest version: gnome-screensaver-2.28.3-1.fc12. I have a Thinkpad X61 that I use on a docking station most of the time. The docking station has another monitor (Viewsonic VP191b) connected to it. Whenever I disconnect my laptop from the dock and connect it back again, the lock dialog shows up on the laptop screen but I can't type the password into it. The mouse and cursor don't appear at all.
I work around the problem by waiting for the "Time expired" message to show up on the lock dialog. After which, the screen goes dark and then, I can move the mouse to get a fully functional lock dialog back on my laptop screen.
Its also worth noting that every time I disconnect the laptop from the docking station, I get the following error message in a notification dialog "Could not switch the monitor configuration. Could not set the configuration for CRT 56"
Any help will be appreciated.
Re comment #7: "This problem" is the vulnerability described in comment #0. Unless you are reporting that the vulnerability still exists, please file a separate bug.
oops! my apologies, I'll file a separate bug.