PT-2012-1113 · X.Org · Xkeyboard-Config+1

Huzaifa S. Sidhpurwala · Published 2012-01-27 · Updated 2014-02-11 · CVE-2012-0064

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xkeyboard-config versions prior to 2.5 X.Org versions prior to 7.6

Description The issue allows physically proximate attackers to bypass an X screen lock via certain keyboard combinations that break the input grab, due to the enabling of certain XKB debugging functions by default. Exploitation of this issue can lead to a violation of confidentiality, integrity, and availability of protected information, and can be performed locally.

Recommendations For xkeyboard-config versions prior to 2.5, consider disabling the XKB debugging functions to prevent exploitation. For X.Org versions prior to 7.6, update to a version that has the XKB debugging functions disabled by default or apply a configuration change to disable these functions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09444

CVE-2012-0064

Affected Products

X.Org

Xkeyboard-Config

References · 15

• https://bdu.fstec.ru/vul/2015-09444 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-0064 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0064 · Vendor Advisory
• http://x.org/wiki/Development/Security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0064 · Security Note
• https://osv.dev/vulnerability/CVE-2012-0064 · Vendor Advisory
• http://securitytracker.com/id?1026549 · Note
• http://lists.x.org/archives/xorg-announce/2012-January/001797.html · Note
• http://openwall.com/lists/oss-security/2012/01/19/6 · Note
• http://osvdb.org/78445 · Note
• http://gu1.aeroxteam.fr/2012/01/19/bypass-screensaver-locker-program-xorg-111-and-up · Note
• http://security.gentoo.org/glsa/glsa-201201-16.xml · Note
• http://who-t.blogspot.com/2012/01/xkb-breaking-grabs-cve-2012-0064.html · Note
• http://lists.x.org/archives/xorg-devel/2012-January/028691.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=783039 · Note