PT-2014-3290 · Gnome · Gnome Shell

Published 2014-04-29 · Updated 2014-04-29 · CVE-2013-7221

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNOME Shell versions prior to 3.10

Description The issue concerns the automatic screen lock functionality in GNOME Shell, which fails to prevent access to the "Enter a Command" dialog. This allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation.

Recommendations For versions prior to 3.10, consider disabling the automatic screen lock functionality or implementing an alternative security measure to prevent unauthorized access to the workstation until a fixed version is available. As a temporary workaround, ensure workstations are attended at all times or implement physical security measures to prevent unauthorized physical access.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-7221

Affected Products

Gnome Shell

References · 11

• https://security-tracker.debian.org/tracker/CVE-2013-7221 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7221 · Security Note
• https://ubuntu.com/security/CVE-2013-7221 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7221 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7221 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7221 · Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=708313 · Note
• https://git.gnome.org/browse/gnome-shell/commit/js/ui/main.js?id=efdf1ff755943fba1f8a9aaeff77daa3ed338088 · Note
• http://openwall.com/lists/oss-security/2013/12/27/4 · Note
• http://openwall.com/lists/oss-security/2013/12/27/8 · Note