Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100208164822.GH2434@redhat.com>
Date: Mon, 8 Feb 2010 09:48:22 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: gnome-screensaver vulnerability (CVE-2010-0414)

This is a heads up on a gnome-screensaver issue that was fixed upstream
today.

In version 2.28, it is possible to circumvent the security of screen
locking functionality by changing the physical monitor configuration.

Details are available in our bugzilla, along with the patch being used
by upstream to correct the issue:

https://bugzilla.redhat.com/show_bug.cgi?id=562217

We have assigned CVE-2010-0414 to this issue.

The code that caused this issue went into gnome-screensaver during the
2.24 development cycle, but auto-configuration of hotplugged monitors
didn't show up until 2.28, and that is a pre-requisite for triggering
the bug, so only 2.28 is vulnerable.

References:

http://git.gnome.org/browse/gnome-screensaver/commit/?id=a5f66339be6719c2b8fc478a1d5fc6545297d950
https://bugzilla.gnome.org/show_bug.cgi?id=609337

-- 
Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.