Bug 58114 - kdm divulges user accounts
kdm divulges user accounts
Product: Red Hat Linux
Classification: Retired
Component: kdebase (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Petr Rockai
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2002-01-08 18:04 EST by Chris Ricker
Modified: 2007-04-18 12:38 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-10-18 13:29:03 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Chris Ricker 2002-01-08 18:04:09 EST
When using kdm in standard configuration (ie, no user browser), typing a correct
account name into the login box is often enough to divulge the fact that the
account name is correct.

Normally, the Session_Type dialog box displays "Default" as the session type. 
If a user has a different session type set in his or her home directory, this
Session_Type box automatically changes to display the preferred Session_type,
even before a password is typed.

Under some circumstances, this can be used to determine whether an account
exists on the system or not.

To fix this, the Session_Type should not be checked by KDM until after the
username *and* password have been verified.
Comment 1 Chris Ricker 2002-03-23 03:21:44 EST
This is true with the skipjack public beta as well.

In KDE3, before the password is even entered, the Session_Type changes to the
previous session for valid users.  This feedback reveals the existance of
Comment 2 Petr Rockai 2005-08-10 12:14:07 EDT
Please retry with current version of Fedora Core. Unless you followup on this      
bug, it will be considered fixed and will be closed at some point... Thank you      
for your time. 
Comment 3 Bill Nottingham 2006-10-18 13:29:03 EDT
Red Hat Linux is no longer supported by Red Hat, Inc. If you are still
running Red Hat Linux, you are strongly advised to upgrade to a
current Fedora Core release or Red Hat Enterprise Linux or comparable.
Some information on which option may be right for you is available at

Closing as CANTFIX.

Note You need to log in before you can comment on or make changes to this bug.