PT-2013-2842 · Gnome · Gnome-Screensaver

Published 2013-03-08 · Updated 2013-03-18 · CVE-2013-1050

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions gnome-screensaver versions 3.5.4 through 3.6.0

Description The default configuration of gnome-screensaver sets the AutostartCondition line to fallback mode, preventing the program from starting automatically after login. This allows physically proximate attackers to bypass screen locking and access an unattended workstation.

Recommendations For gnome-screensaver versions 3.5.4 through 3.6.0, consider modifying the AutostartCondition line in the .desktop file to enable automatic startup after login, thereby preventing attackers from bypassing screen locking.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-1050

Affected Products

Gnome-Screensaver

References · 5

• http://ubuntu.com/usn/USN-1716-1 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1120126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1050 · Security Note
• https://bugzilla.gnome.org/show_bug.cgi?id=683060 · Note
• https://git.gnome.org/browse/gnome-screensaver/commit/?id=1940dc6bc8ad5ee2c029714efb1276c05ca80bd4 · Note