PT-2006-1054 · Gnome · Gnome Gdm

Vã­Ctor Daniel · Published 2006-06-09 · Updated 2018-10-03 · CVE-2006-2452

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: GNOME GDM versions 2.8 through 2.15

Description: The issue allows local users to access the "Configure Login Manager" functionality using their own password instead of the root password when the "face browser" feature is enabled. This can be leveraged to gain additional privileges. Exploitation of the vulnerability may lead to a breach of confidentiality, integrity, and availability of protected information, and it can be exploited locally.

Recommendations: For GNOME GDM versions 2.8 through 2.15, consider disabling the "face browser" feature to prevent unauthorized access to the "Configure Login Manager" functionality until a patch is available. Restrict access to the "Configure Login Manager" to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09511

CVE-2006-2452

Affected Products

Gnome Gdm

References · 17

• http://mandriva.com/security/advisories?name=MDKSA-2006:100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2452 · Security Note
• https://bdu.fstec.ru/vul/2015-09511 · Security Note
• http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html · Vendor Advisory
• https://usn.ubuntu.com/293-1 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200606-14.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200606-14.xml · Note
• http://secunia.com/advisories/20532 · Note
• http://securityfocus.com/bid/18332 · Note
• http://bugzilla.gnome.org/show_bug.cgi?id=343476 · Note
• http://secunia.com/advisories/20627 · Note
• http://securityfocus.com/archive/1/436428 · Note
• http://vupen.com/english/advisories/2006/2239 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27018 · Note
• http://secunia.com/advisories/20587 · Note