PT-2008-1071 · Gnome+1 · Gnome-Screensaver+1

Published 2008-04-02 · Updated 2017-09-29 · CVE-2008-0887

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions gnome-screensaver versions prior to 2.22.1 gnome-screensaver version 2.16.1 gnome-screensaver versions prior to 2.20.0-r3

Description The issue allows physically proximate attackers to gain access to a locked session when a remote authentication server is enabled and the system experiences a network outage, causing the screensaver to crash upon an unlock attempt. This can lead to a violation of protected information. The exploitation of this issue can be performed locally.

Recommendations For gnome-screensaver versions prior to 2.22.1, update to version 2.22.1 or later to resolve the issue. For gnome-screensaver version 2.16.1, update to a version later than 2.16.1 to mitigate the risk. For gnome-screensaver versions prior to 2.20.0-r3, update to version 2.20.0-r3 or later to fix the issue. As a temporary workaround, consider disabling remote authentication server functionality until a patch is available.

Exploit

Fix

Related Identifiers

BDU:2015-06668

BDU:2015-09626

CVE-2008-0887

RHSA-2008:0197

RHSA-2008:0218

RHSA-2008_0197

RHSA-2008_0218

Affected Products

Red Hat

Gnome-Screensaver

References · 29

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=435773 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00206.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-0197.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00163.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-12.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:132 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0887 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0218.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0887 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-0887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0887 · Security Note
• https://bdu.fstec.ru/vul/2015-09626 · Security Note
• https://bdu.fstec.ru/vul/2015-06668 · Security Note
• http://ubuntu.com/usn/USN-669-1 · Vendor Advisory