PT-2021-4269 · Unknown+1 · Xscreensaver+1

Mustafa Kuscu · Published 2021-06-05 · Updated 2022-08-03 · CVE-2021-34557

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XScreenSaver version 5.45

Description The issue is related to a buffer overflow in the update screen layout() function, which can be exploited by an attacker to bypass the standard screen lock authentication mechanism. This can be achieved by crashing XScreenSaver when the machine has more than ten disconnectable video outputs, requiring the attacker to physically disconnect many video outputs. The exploitation of this issue may allow an attacker to cause a denial of service.

Recommendations For XScreenSaver version 5.45, as a temporary workaround, consider restricting the number of disconnectable video outputs to minimize the risk of exploitation. Additionally, avoid using the update screen layout() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2021-04877

CVE-2021-34557

MGASA-2021-0278

OPENSUSE-SU-2022_2641-1

SUSE-SU-2022:2641-1

SUSE-SU-2022:2642-1

SUSE-SU-2022_2641-1

SUSE-SU-2022_2642-1

Affected Products

Suse

Xscreensaver

References · 27

• 🔥 https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt · Exploit
• 🔥 https://openwall.com/lists/oss-security/2021/06/05/1 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2021/07/06/2 · Exploit
• https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34557 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34557 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0278.html · Security Note
• https://ubuntu.com/security/CVE-2021-34557 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04877 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34557 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-34557 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34557 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0278 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2641-1 · Vendor Advisory