Bug 58114 - kdm divulges user accounts
Summary: kdm divulges user accounts
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: kdebase
Version: 7.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Petr Rockai
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2002-01-08 23:04 UTC by Chris Ricker
Modified: 2007-04-18 16:38 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2006-10-18 17:29:03 UTC
Embargoed:


Attachments (Terms of Use)

Description Chris Ricker 2002-01-08 23:04:09 UTC
When using kdm in standard configuration (ie, no user browser), typing a correct
account name into the login box is often enough to divulge the fact that the
account name is correct.

Normally, the Session_Type dialog box displays "Default" as the session type. 
If a user has a different session type set in his or her home directory, this
Session_Type box automatically changes to display the preferred Session_type,
even before a password is typed.

Under some circumstances, this can be used to determine whether an account
exists on the system or not.

To fix this, the Session_Type should not be checked by KDM until after the
username *and* password have been verified.

Comment 1 Chris Ricker 2002-03-23 08:21:44 UTC
This is true with the skipjack public beta as well.

In KDE3, before the password is even entered, the Session_Type changes to the
previous session for valid users.  This feedback reveals the existance of
accounts....

Comment 2 Petr Rockai 2005-08-10 16:14:07 UTC
Please retry with current version of Fedora Core. Unless you followup on this      
bug, it will be considered fixed and will be closed at some point... Thank you      
for your time. 

Comment 3 Bill Nottingham 2006-10-18 17:29:03 UTC
Red Hat Linux is no longer supported by Red Hat, Inc. If you are still
running Red Hat Linux, you are strongly advised to upgrade to a
current Fedora Core release or Red Hat Enterprise Linux or comparable.
Some information on which option may be right for you is available at
http://www.redhat.com/rhel/migrate/redhatlinux/.

Closing as CANTFIX.


Note You need to log in before you can comment on or make changes to this bug.