Bug 336331 (CVE-2007-5585) - CVE-2007-5585 password prompt crashes by gl hacks without gl helper
Summary: CVE-2007-5585 password prompt crashes by gl hacks without gl helper
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-5585
Product: Fedora
Classification: Fedora
Component: xscreensaver
Version: 7
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Mamoru TASAKA
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 357841 (view as bug list)
Depends On:
Blocks: F8Blocker
TreeView+ depends on / blocked
 
Reported: 2007-10-17 15:54 UTC by Patrick C. F. Ernzer
Modified: 2007-11-30 22:12 UTC (History)
3 users (show)

Fixed In Version: 0-0.4.20070929.fc7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-10-24 07:16:16 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
xscreensaver -sync -verbose -no-capture (61.04 KB, text/plain)
2007-10-17 15:54 UTC, Patrick C. F. Ernzer
no flags Details
now I got a core (776.00 KB, application/octet-stream)
2007-10-18 11:40 UTC, Patrick C. F. Ernzer
no flags Details
xscreensaver -sync -verbose -no-capture (47.83 KB, text/plain)
2007-10-18 11:43 UTC, Patrick C. F. Ernzer
no flags Details

Description Patrick C. F. Ernzer 2007-10-17 15:54:17 UTC
Description of problem:
xscreensaver has started crashing a few days ago

Version-Release number of selected component (if applicable):
xscreensaver-5.03-10.fc7.src.rpm

How reproducible:
sometimes

Steps to Reproduce:
1. lock screen
2. leave computer
3. come back and wiggle mouse if screen dark
  
Actual results:
screen unlocked without entering password

Expected results:
screen remains locked until I enter my password

Additional info:
output of "xscreensaver -sync -verbose -no-capture" will be attached.
stupidly enough I forgot to up the ulimit -c from 0.
it's running in sync and verbose mode again after "ulimit -c 2048". Will update
this BZ if it craps out again.

Comment 1 Patrick C. F. Ernzer 2007-10-17 15:54:17 UTC
Created attachment 229981 [details]
xscreensaver -sync -verbose -no-capture

Comment 2 Patrick C. F. Ernzer 2007-10-17 15:55:04 UTC
setting NEEDINFO on me until such time that I submit a core

Comment 3 Patrick C. F. Ernzer 2007-10-18 11:40:03 UTC
Created attachment 230961 [details]
now I got a core

Comment 4 Patrick C. F. Ernzer 2007-10-18 11:43:00 UTC
Created attachment 230971 [details]
xscreensaver -sync -verbose -no-capture

this is the output "xscreensaver -sync -verbose -no-capture" in the run that
generated the core in (private) attachment 230961 [details]

Comment 5 Mamoru TASAKA 2007-10-18 11:53:36 UTC
(In reply to comment #4)
> this is the output "xscreensaver -sync -verbose -no-capture" in the run that
> generated the core in (private) attachment 230961 [details] [edit]

This returns "You are not authorized to access this attachment." (for me)...

Comment 6 Patrick C. F. Ernzer 2007-10-18 12:32:42 UTC
in reply to Comment #5
oh, sorry, fixed now.

Comment 7 Mamoru TASAKA 2007-10-18 13:28:01 UTC
I guess you don't have xscreensaver-gl-extras installed
and rss-glx-xscreensaver installed, right? 
In this case, the crash can be reproduced to me on rawhide.

If so, would you check if your crash still occur even if
you have xscreensaver-gl-extras (more precisely, 
the binary /usr/bin/xscreensaver-gl-helper ) installed?

Comment 8 Mamoru TASAKA 2007-10-18 14:28:32 UTC
(In reply to comment #7)
> I guess you don't have xscreensaver-gl-extras installed
> and rss-glx-xscreensaver installed, right? 

To avoid confusion, I wanted to say that I guess you don't
have xscreensaver-gl-extras installed but you have rss-glx-xscreensaver
(and rss-glx) installed.


Comment 9 Mamoru TASAKA 2007-10-18 14:38:01 UTC
Also:
if my guess is correct (i.e. you don't have xscreensaver-gl-extras
installed), when you
- make it sure that you have xscreensaver-base, rss-glx, rss-glx-xscreensaver
  installed
- remove xscreensaver-extras 
- launch xscreensaver
- type "xscreensaver-command -lock" as login user
- and try to unlock
then you probably get crash more frequently.

Comment 10 Patrick C. F. Ernzer 2007-10-18 15:53:58 UTC
In reply to comments #7 and #8:
$ rpm -q xscreensaver-gl-extras rss-glx-xscreensaver xscreensaver-base rss-glx
rss-glx-xscreensaver
package xscreensaver-gl-extras is not installed
rss-glx-xscreensaver-0.8.1.p-11.fc7
xscreensaver-base-5.03-10.fc7
rss-glx-0.8.1.p-11.fc7
rss-glx-xscreensaver-0.8.1.p-11.fc7



In reply to comment #9:
removed xscreensaver-extras and was able to reproduce the crash 3 times in a row
with "xscreensaver-command -lock"

I have now added xscreensaver-gl-extras to my system (but xscreensaver-extras is
still left off) will see if it crashes in the nwxt few days.)

Do I understand correctly from comment #8 that the rss-glx-xscreensaver RPM
should have a dependency on xscreensaver-gl-extras ?

Comment 11 Mamoru TASAKA 2007-10-18 16:07:38 UTC
(In reply to comment #10)
> Do I understand correctly from comment #8 that the rss-glx-xscreensaver RPM
> should have a dependency on xscreensaver-gl-extras ?
I have to have a discussion with Nils.

Hello, Nils:
It seems that GL hacks makes xscreensaver crash when xscreensaver is
locked and the user tries to type a password to unlock the display,
when /usr/bin/xscreensaver-gl-helper is not available.
So rss-glx-xscreensaver should require /usr/bin/xscreensaver-gl-helper.

Then:
- simply adding "Requires: xscreensaver-gl-extras" to
  rss-glx-xscreensaver is preferable? Where I dislike this is that
  rss-glx-xscreensaver does not actually need the whole
  xscreensaver-gl-extras, only gl helper is needed.
- or I will create xscreensaver-gl-base subpackage. move gl helper
  to xscreensaver-gl-base and make rss-glx-xscreensaver require
  xscreensaver-gl-base?

Comment 12 Nils Philippsen 2007-10-19 07:42:13 UTC
(In reply to comment #11)
> (In reply to comment #10)
> > Do I understand correctly from comment #8 that the rss-glx-xscreensaver RPM
> > should have a dependency on xscreensaver-gl-extras ?
> I have to have a discussion with Nils.
> 
> Hello, Nils:
> It seems that GL hacks makes xscreensaver crash when xscreensaver is
> locked and the user tries to type a password to unlock the display,
> when /usr/bin/xscreensaver-gl-helper is not available.
> So rss-glx-xscreensaver should require /usr/bin/xscreensaver-gl-helper.
> 
> Then:
> - simply adding "Requires: xscreensaver-gl-extras" to
>   rss-glx-xscreensaver is preferable? Where I dislike this is that
>   rss-glx-xscreensaver does not actually need the whole
>   xscreensaver-gl-extras, only gl helper is needed.
> - or I will create xscreensaver-gl-base subpackage. move gl helper
>   to xscreensaver-gl-base and make rss-glx-xscreensaver require
>   xscreensaver-gl-base?

While "Require: /usr/bin/xscreensaver-gl-helper" would be the cleanest thing to
do in rss-glx-xscreensaver, I like to avoid dependencies on files as they're
potentially expensive at the dependency solving stage in yum. The next cleanest
thing would be a split off helper binary and a requirement on that package
("Requires: xscreensaver-gl-base"). I agree that requiring the whole of
xscreensaver-gl-extras is a bit over the top.

Comment 13 Mamoru TASAKA 2007-10-19 08:15:39 UTC
(In reply to comment #12)
> I like to avoid dependencies on files as they're
> potentially expensive at the dependency solving stage in yum. 
I agree.

> The next cleanest
> thing would be a split off helper binary and a requirement on that package
> ("Requires: xscreensaver-gl-base"). 
Okay. Then I will create a new "xscreensaver-gl-base" subpackage and
split off "/usr/bin/xscrensaver-gl-helper" (and its man file) to
xscreensaver-gl-base.

Comment 14 Mamoru TASAKA 2007-10-19 08:25:56 UTC
Well, it seems that now ACL is now blocked for mass F-8 branching.
https://www.redhat.com/archives/fedora-devel-list/2007-October/msg01465.html

I will commit the change (for xscreensaver) when CVS is again open,
rebuild, then I will notice on this bug.

Comment 15 Mamoru TASAKA 2007-10-19 08:45:31 UTC
Hello, Ian:

Now we decided that packages which contain xscreensaver GL hacks
should require xscreensaver-gl-base (xscreensaver-gl-base will be
created in xscreensaver 5.03-12). So tempest-xscreensaver should
also have "Requires; xscreensaver-gl-base".
Also, conf file in tempest-xscreensaver had a copy-and-paste typo
which has to be fixed.

I uploaded a new tempest srpm on
http://mtasaka.fedorapeople.org/Bugfix/tempest-0-0.3.20070929.fc8.src.rpm

Would you rebuild this srpm on devel, F-8 and F-7
once CVS is unlocked again?

Comment 17 Mamoru TASAKA 2007-10-19 13:32:30 UTC
(In reply to comment #15)
> Hello, Ian:
 
> I uploaded a new tempest srpm on
> http://mtasaka.fedorapeople.org/Bugfix/tempest-0-0.3.20070929.fc8.src.rpm
> 
> Would you rebuild this srpm on devel, F-8 and F-7
> once CVS is unlocked again?

Well, this srpm again has a mistake...
For tempest I will submit a new CVS commit for this bug by myself, so
please don't worry, Ian.



Comment 18 Mamoru TASAKA 2007-10-19 14:45:28 UTC
tempest also done.

Comment 19 Nils Philippsen 2007-10-19 15:45:56 UTC
rss-glx-0.8.1.p-15.fc{7,8} now built:

http://koji.fedoraproject.org/koji/buildinfo?buildID=21646
http://koji.fedoraproject.org/koji/buildinfo?buildID=21643

Mamoru, will you push the F7 and F8(*) packages through Bodhi together? Thanks.

(*) AFAIK, as F8 is now frozen, these get scheduled as updates if you don't tell
rel-eng that they should go into the final release.

Comment 20 Mamoru TASAKA 2007-10-19 16:12:31 UTC
(In reply to comment #19)
> rss-glx-0.8.1.p-15.fc{7,8} now built:
> 
> http://koji.fedoraproject.org/koji/buildinfo?buildID=21646
> http://koji.fedoraproject.org/koji/buildinfo?buildID=21643

Thanks.
> 
> Mamoru, will you push the F7 and F8(*) packages through Bodhi together? Thanks.
> 
> (*) AFAIK, as F8 is now frozen, these get scheduled as updates if you don't tell
> rel-eng that they should go into the final release.

For F-8, I mailed to rel-eng team.
Once rel-eng team accepted for F-8, I will request a new update for F-7
on bodhi as security ("as security" means that testing repo is skipped).



Comment 21 Lubomir Kundrak 2007-10-19 17:38:05 UTC
The CVE Identifier for this issue has been requested.

Please always add Security keyword to bugs that might have Security impact to
ensure proper and timely Security Response Team reaction. Thanks!

Comment 22 Fedora Update System 2007-10-24 07:16:14 UTC
tempest-0-0.4.20070929.fc7, rss-glx-0.8.1.p-15.fc7, xscreensaver-5.03-12.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 23 Mamoru TASAKA 2007-10-31 09:19:07 UTC
*** Bug 357841 has been marked as a duplicate of this bug. ***

Comment 24 Fedora Update System 2007-11-01 21:20:19 UTC
xscreensaver-5.03-14.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2007-11-06 16:14:37 UTC
xscreensaver-5.03-14.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.