PT-2012-1300 · Gnome · Gnome Display Manager

Antoine Jacoutot · Published 2012-12-21 · Updated 2017-08-17 · CVE-2010-2387

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNOME Display Manager versions 2.20.x through 2.20.10

Description The issue allows local users to potentially gain privileges by reading information from syslog logs when GDM debug is enabled and the user password contains invalid UTF8 encoded characters.

Recommendations For GNOME Display Manager versions 2.20.x through 2.20.10, update to version 2.20.11 or later to resolve the issue. As a temporary workaround, consider disabling GDM debug to minimize the risk of exploitation. Restrict access to syslog logs to prevent unauthorized users from reading the sensitive information.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-2387

Affected Products

Gnome Display Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2010-2387 · Security Note
• http://secunia.com/advisories/40780 · Vendor Advisory
• http://secunia.com/advisories/40690 · Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=571846 · Note
• http://osvdb.org/66643 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60642 · Note
• http://auscert.org.au/13123 · Note
• https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure · Note
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes · Note