CVE-2010-0732: security - Re: Re: CVE Request: gnome-screensaver termination by pressing "Enter"

• Products
  • Openwall GNU/*/Linux server OS
  • Linux Kernel Runtime Guard
  • John the Ripper password cracker
    • Free & Open Source for any platform
    • in the cloud
    • Pro for Linux
    • Pro for macOS
  • Wordlists for password cracking
  • passwdqc policy enforcement
    • Free & Open Source for Unix
    • Pro for Windows (Active Directory)
  • yescrypt KDF & password hashing
  • yespower Proof-of-Work (PoW)
  • crypt_blowfish password hashing
  • phpass ditto in PHP
  • tcb better password shadowing
  • Pluggable Authentication Modules
  • scanlogd port scan detector
  • popa3d tiny POP3 daemon
  • blists web interface to mailing lists
  • msulogin single user mode login
  • php_mt_seed mt_rand() cracker
• Services
• Publications
  • Articles
  • Presentations
• Resources
  • Mailing lists
  • Community wiki
  • Source code repositories (GitHub)
  • Source code repositories (CVSweb)
  • File archive & mirrors
  • How to verify digital signatures
  • OVE IDs
• What’s new

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 16 Mar 2010 11:11:07 -0600 From: Vincent Danen <vdanen@…hat.com> To: oss-security@…ts.openwall.com Cc: “Steven M. Christey” <coley@…us.mitre.org> Subject: Re: Re: CVE Request: gnome-screensaver termination by pressing “Enter”

* [2010-03-05 10:09:58 +0100] Marcus Meissner wrote:

Can someone, Stephen, assign a CVE id please?

Please use CVE-2010-0732 for this issue.

Also note that our maintainer looked at this and indicates this is a bug in GTK+, not gnome-screensaver, and that this commit actually corrects the problem:

http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1

See the comments in our bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=565527#c3

On Fri, Feb 12, 2010 at 10:53:24AM +0100, Marcus Meissner wrote:

Hi,

Yesterday an article was published by Heise News (a german IT magazine) that said that the Gnome Screensaver in openSUSE 11.2 is unlockable by just pressing the “return” key for some time.

The issue as far as we know is the following:

The unlock dialog shakes if you enter the wrong password. On the last try, this dialog is also hidden again (so screen is blanked).

There is race condition between these two actions which can lead to an X error which aborts the screensaver (and so unlocks the screen).

It is fixed in gnome-screensaver 2.28.1 release.

References:

The fixing commit in the 2.28 branch: http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520

The news article (in german): http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-928580.html

The GNOME upstream bug: http://bugzilla.gnome.org/show_bug.cgi?id=598476

I think this does not have a CVE id yet, so please someone allocate one.

I am not sure when this shaking was introduced, but it might be pretty new.

Ciao, Marcus

– Working, but not speaking, for the following german company: SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

– Vincent Danen / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.