PT-2014-3992 · Canonical · Lightdm Gtk+ Greeter

Gber + 1 · Published 2014-01-23 · Updated 2018-10-30 · CVE-2014-0979

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LightDM GTK+ Greeter versions prior to 1.7.1

Description The issue arises from the start authentication function in lightdm-gtk-greeter.c, which fails to handle the return value from the lightdm greeter get authentication user function correctly. This allows local users to cause a denial of service, specifically a NULL pointer dereference, by providing an empty username.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider validating user input to prevent empty usernames from being processed by the start authentication function.

Fix

Related Identifiers

CVE-2014-0979

MGASA-2014-0026

Affected Products

Lightdm Gtk+ Greeter

References · 20

• http://lists.opensuse.org/opensuse-updates/2014-01/msg00048.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0979 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0979 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128117.html · Vendor Advisory
• http://secunia.com/advisories/56211 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128150.html · Vendor Advisory
• http://secunia.com/advisories/56423 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0026.html · Security Note
• https://osv.dev/vulnerability/CVE-2014-0979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0979 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0026 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0979 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-0979 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/01/07/15 · Note