PT-2007-7520 · Xorg+3 · Xorg-X11-Xnest+6

Published 1970-01-01 · Updated 2017-09-29 · CVE-2007-3920

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNOME screensaver version 2.20 xorg-x11-Xvnc (affected versions not specified) xorg-x11-Xvfb (affected versions not specified) xorg-x11-server (affected versions not specified) xorg-x11-Xnest (affected versions not specified)

Description The issue allows attackers to take control of a session after entering an Alt-Tab sequence, due to improper reservation of input focus. Multiple vulnerabilities in the xorg-x11 packages of SUSE Linux Enterprise may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For GNOME screensaver version 2.20, consider disabling the Alt-Tab sequence as a temporary workaround until a patch is available. For xorg-x11-Xvnc, restrict access to the package to minimize the risk of exploitation. For xorg-x11-Xvfb, avoid using the package until the issue is resolved. For xorg-x11-server, consider disabling remote access to the server as a temporary mitigation measure. For xorg-x11-Xnest, restrict access to the package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-04179

BDU:2015-04180

BDU:2015-04181

BDU:2015-04182

CVE-2007-3920

DTSA-75-1

RHSA-2008:0485

RHSA-2008_0485

Affected Products

Gnome-Screensaver

Red Hat

Suse Linux Enterprise

Xorg-X11-Xnest

Xorg-X11-Xvfb

Xorg-X11-Xvnc

Xorg-X11-Server

References · 26

• https://bdu.fstec.ru/vul/2015-04180 · Security Note
• http://securityfocus.com/bid/26188 · Patch
• http://ubuntu.com/usn/usn-537-2 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00841.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04179 · Security Note
• https://bdu.fstec.ru/vul/2015-04181 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00811.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3920 · Security Note
• http://secunia.com/advisories/27381 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0485.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3920 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04182 · Security Note
• https://osv.dev/vulnerability/CVE-2007-3920 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3920 · Vendor Advisory