PT-2014-2788 · Xcb · Pyxtrlock

Kurt Seifried · Published 2014-05-19 · Updated 2014-05-19 · CVE-2013-4427

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions pyxtrlock versions prior to 0.2

Description The issue arises from improper checking of return values of the xcb grab pointer and xcb grab keyboard XCB library functions. This allows physically proximate attackers to gain access to the keyboard or mouse without unlocking the screen.

Recommendations For pyxtrlock versions prior to 0.2, update to version 0.2 or later to resolve the issue. As a temporary workaround, consider restricting physical access to devices running the affected software until the update can be applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-4427

Affected Products

Pyxtrlock

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4427 · Security Note
• https://github.com/leonnnn/pyxtrlock/blob/master/CHANGELOG · Note
• http://openwall.com/lists/oss-security/2013/09/25/16 · Note
• http://openwall.com/lists/oss-security/2013/10/16/8 · Note