PT-2003-1069 · Gnome · Gdm

George · Published 2003-08-21 · Updated 2017-10-11 · CVE-2003-0547

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GDM versions prior to 2.4.1.6 GDM version 2.0beta2 GDM version 2.2.3.1

Description The issue allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file when using the "examine session errors" feature. Additionally, multiple vulnerabilities in the GDM package may lead to disruption of protected information and can be exploited remotely.

Recommendations For GDM versions prior to 2.4.1.6, update to version 2.4.1.6 or later to resolve the issue. For GDM version 2.0beta2, consider disabling the "examine session errors" feature until a patch is available. For GDM version 2.2.3.1, restrict access to the ~/.xsession-errors file to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-07974

BDU:2015-07975

CVE-2003-0547

Affected Products

Gdm

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2003-0547 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000729 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07974 · Security Note
• https://bdu.fstec.ru/vul/2015-07975 · Security Note
• http://redhat.com/support/errata/RHSA-2003-258.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2003-258.html · Note
• http://marc.info/?l=bugtraq&m=106194792924122&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A112 · Note
• http://mail.gnome.org/archives/gnome-hackers/2003-August/msg00045.html · Note