PT-2013-5049 · Ibm+2 · Ibus+2

Vincent Danen · Published 2013-11-23 · Updated 2023-02-13 · CVE-2013-4509

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBUS versions 1.5.2 through 1.5.4

Description The default configuration of IBUS, when used with GNOME 3 and IBus.InputPurpose.PASSWORD is not set, does not obscure the entered password characters. This allows physically proximate attackers to obtain a user password by reading the lockscreen.

Recommendations For IBUS versions 1.5.2 through 1.5.4, consider setting IBus.InputPurpose.PASSWORD to obscure the entered password characters. As a temporary workaround, users can manually configure their settings to hide password input on the lockscreen until a patch is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

ALT-PU-2014-1181

CVE-2013-4509

OPENSUSE-SU-2024:10500-1

Affected Products

Alt Linux

Gnome

Ibus

References · 14

• https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a5edfe7 · Patch
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4509 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4509 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4509 · Vendor Advisory
• https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozc_support_ibus-1.5.4_rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690 · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-4509 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1181 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4509 · Security Note
• https://groups.google.com/forum/#%21topic/ibus-user/mvCHDO1BJUw · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1027028 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2013-4509 · Note