PT-2012-1300 · Gnome · Gnome Display Manager

Antoine Jacoutot · Publicado 2012-12-21 · Atualizado 2017-08-17 · CVE-2010-2387

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNOME Display Manager versions 2.20.x through 2.20.10

Description The issue allows local users to potentially gain privileges by reading information from syslog logs when GDM debug is enabled and the user password contains invalid UTF8 encoded characters.

Recommendations For GNOME Display Manager versions 2.20.x through 2.20.10, update to version 2.20.11 or later to resolve the issue. As a temporary workaround, consider disabling GDM debug to minimize the risk of exploitation. Restrict access to syslog logs to prevent unauthorized users from reading the sensitive information.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-2387

Produtos afetados

Gnome Display Manager

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2010-2387 · Nota de Segurança
• http://secunia.com/advisories/40780 · Aviso do Fabricante
• https://bugzilla.gnome.org/show_bug.cgi?id=571846 · Nota
• http://osvdb.org/66643 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60642 · Nota
• http://auscert.org.au/13123 · Nota
• https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure · Nota
• http://secunia.com/advisories/40690 · Aviso do Fabricante
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes · Nota