Red Hat Bugzilla – Bug 58114
kdm divulges user accounts
Last modified: 2007-04-18 12:38:55 EDT
When using kdm in standard configuration (ie, no user browser), typing a correct
account name into the login box is often enough to divulge the fact that the
account name is correct.
Normally, the Session_Type dialog box displays "Default" as the session type.
If a user has a different session type set in his or her home directory, this
Session_Type box automatically changes to display the preferred Session_type,
even before a password is typed.
Under some circumstances, this can be used to determine whether an account
exists on the system or not.
To fix this, the Session_Type should not be checked by KDM until after the
username *and* password have been verified.
This is true with the skipjack public beta as well.
In KDE3, before the password is even entered, the Session_Type changes to the
previous session for valid users. This feedback reveals the existance of
Please retry with current version of Fedora Core. Unless you followup on this
bug, it will be considered fixed and will be closed at some point... Thank you
for your time.
Red Hat Linux is no longer supported by Red Hat, Inc. If you are still
running Red Hat Linux, you are strongly advised to upgrade to a
current Fedora Core release or Red Hat Enterprise Linux or comparable.
Some information on which option may be right for you is available at
Closing as CANTFIX.