National Cyber Awareness System

Vulnerability Summary for CVE-2007-1859

Overview

XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: REDHAT

Name: RHSA-2007:0322

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0322.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1293

Hyperlink:https://issues.rpath.com/browse/RPL-1293

External Source: XF

Name: xscreensaver-getpwuid-authentication-bypass(34054)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34054

External Source: UBUNTU

Name: USN-474-1

Hyperlink:http://www.ubuntu.com/usn/usn-474-1

External Source: SECTRACK

Name: 1017996

Hyperlink:http://www.securitytracker.com/id?1017996

External Source: BID

Name: 23783

Hyperlink:http://www.securityfocus.com/bid/23783

External Source: SUSE

Name: SUSE-SR:2007:009

Hyperlink:http://www.novell.com/linux/security/advisories/2007_9_sr.html

External Source: MANDRIVA

Name: MDKSA-2007:097

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:097

External Source: GENTOO

Name: GLSA-200705-14

Hyperlink:http://security.gentoo.org/glsa/glsa-200705-14.xml

External Source: SECUNIA

Name: 25610

Hyperlink:http://secunia.com/advisories/25610

External Source: SECUNIA

Name: 25225

Type: Advisory

Hyperlink:http://secunia.com/advisories/25225

External Source: SECUNIA

Name: 25119

Type: Advisory

Hyperlink:http://secunia.com/advisories/25119

External Source: SECUNIA

Name: 25118

Type: Advisory

Hyperlink:http://secunia.com/advisories/25118

External Source: SECUNIA

Name: 25116

Type: Advisory

Hyperlink:http://secunia.com/advisories/25116

External Source: SECUNIA

Name: 25105

Type: Advisory

Hyperlink:http://secunia.com/advisories/25105

External Source: SECUNIA

Name: 25065

Type: Advisory

Hyperlink:http://secunia.com/advisories/25065

External Source: OVAL

Name: oval:org.mitre.oval:def:11459

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11459

External Source: OSVDB

Name: 35531

Hyperlink:http://osvdb.org/35531

References to Check Content

Identifier:oval:org.mitre.oval:def:11459

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11459