gnome-screensaver before 2.22.1, when a remote authentication server is enabled, crashes upon an unlock attempt during a network outage, which allows physically proximate attackers to gain access to the locked session, a related issue to CVE-2007-1859.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2008-0218 advisory.

  - gnome-screensaver before 2.22.1, when a remote authentication server is enabled, crashes upon an unlock     attempt during a network outage, which allows physically proximate attackers to gain access to the locked     session, a related issue to CVE-2007-1859. (CVE-2008-0887)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2008-0197 advisory.

    [2.16.1-5.1]     Resolves: #436521
    - don't unlock the screen when pwent lookup fails

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way gnome-screensaver verified user passwords.
When a system used a remote directory service for login credentials, a local attacker able to cause a network outage could cause gnome-screensaver to crash, unlocking the screen. (CVE-2008-0887)

An updated gnome-screensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

gnome-screensaver is the GNOME project's official screen saver program.

A flaw was found in the way gnome-screensaver verified user passwords.
When a system used a remote directory service for login credentials, a local attacker able to cause a network outage could cause gnome-screensaver to crash, unlocking the screen. (CVE-2008-0887)

Users of gnome-screensaver should upgrade to this updated package, which contains a backported patch to correct this issue.

Following security problem is fixed by this patch :

  - When getpwuid() fails (due to dropped network on NIS     accounts) fail instead of silently disabling locking     (and just blanking). (CVE-2008-1683)

A vulnerability was found in gnome-screensaver prior to 2.22.1 when a remote authentication server was enabled. During a network outage, gnome-screensaver would crash upon an unlock attempt, allowing physically local users to gain access to locked sessions (CVE-2008-0887).

The updated packages have been patched to correct this issue.

It was discovered that the notify feature in gnome-screensaver could let a local attacker read the clipboard contents of a locked session by using Ctrl-V. (CVE-2007-6389)

Alan Matsuoka discovered that gnome-screensaver did not properly handle network outages when using a remote authentication service.
During a network interruption, or by disconnecting the network cable, a local attacker could gain access to locked sessions. (CVE-2008-0887).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Following security problem is fixed by this patch :

CVE-2008-1683: When getpwuid() fails (due to dropped network on NIS accounts) fail instead of silently disabling locking (and just blanking).

An attacker could log in without a valid password if the NIS server is down. (CVE-2008-0887)

An updated gnome-screensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux FasTrack 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

gnome-screensaver is the GNOME project's official screen saver program.

A flaw was found in the way gnome-screensaver verified user passwords.
When a system used a remote directory service for login credentials, a local attacker able to cause a network outage could cause gnome-screensaver to crash, unlocking the screen. (CVE-2008-0887)

Users of gnome-screensaver should upgrade to this updated package, which contains a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200804-12 (gnome-screensaver: Privilege escalation)

    gnome-screensaver incorrectly handles the results of the getpwuid()     function in the file src/setuid.c when using directory servers (like     NIS) during a network outage, a similar issue to GLSA 200705-14.
  Impact :

    A local user can crash gnome-xscreensaver by preventing network     connectivity if the system uses a remote directory service for     credentials such as NIS or LDAP, which will unlock the screen.
  Workaround :

    There is no known workaround at this time.

Update for advisory CVE-2008-0887

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that xscreensaver did not correctly validate the return values from network authentication systems such as LDAP or NIS.
A local attacker could bypass a locked screen if they were able to interrupt network connectivity.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A problem with the way xscreensaver verifies user passwords was discovered by Alex Yamauchi. When a system is using remote authentication (i.e. LDAP) for logins, a local attacker able to cause a network outage on the system could cause xscreensaver to crash, which would unlock the screen.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
180602	Oracle Linux 5 : gnome-screensaver (ELSA-2008-0218)	Nessus	Oracle Linux Local Security Checks	critical
67673	Oracle Linux 5 : gnome-screensaver (ELSA-2008-0197)	Nessus	Oracle Linux Local Security Checks	critical
60379	Scientific Linux Security Update : gnome-screensaver on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43679	CentOS 5 : gnome-screensaver (CESA-2008:0197)	Nessus	CentOS Local Security Checks	medium
41216	SuSE9 Security Update : xscreensaver (YOU Patch Number 12174)	Nessus	SuSE Local Security Checks	medium
37475	Mandriva Linux Security Advisory : gnome-screensaver (MDVSA-2008:132)	Nessus	Mandriva Local Security Checks	medium
36364	Ubuntu 6.06 LTS / 7.10 : gnome-screensaver vulnerabilities (USN-669-1)	Nessus	Ubuntu Local Security Checks	medium
33743	SuSE 10 Security Update : xscreensaver (ZYPP Patch Number 5334)	Nessus	SuSE Local Security Checks	medium
33742	openSUSE 10 Security Update : xscreensaver (xscreensaver-5333)	Nessus	SuSE Local Security Checks	medium
33267	openSUSE 10 Security Update : gnome-screensaver (gnome-screensaver-5172)	Nessus	SuSE Local Security Checks	medium
33251	SuSE 10 Security Update : gnome-screensaver (ZYPP Patch Number 5179)	Nessus	SuSE Local Security Checks	medium
33215	openSUSE 10 Security Update : gnome-screensaver (gnome-screensaver-5175)	Nessus	SuSE Local Security Checks	medium
32420	RHEL 5 : gnome-screensaver (RHSA-2008:0218)	Nessus	Red Hat Local Security Checks	medium
31959	GLSA-200804-12 : gnome-screensaver: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
31826	Fedora 8 : gnome-screensaver-2.20.0-12.fc8 (2008-3017)	Nessus	Fedora Local Security Checks	medium
31819	Fedora 7 : gnome-screensaver-2.18.2-4.fc7 (2008-2967)	Nessus	Fedora Local Security Checks	medium
31755	RHEL 5 : gnome-screensaver (RHSA-2008:0197)	Nessus	Red Hat Local Security Checks	medium
28075	Ubuntu 6.06 LTS / 6.10 / 7.04 : xscreensaver vulnerability (USN-474-1)	Nessus	Ubuntu Local Security Checks	medium
25157	Mandrake Linux Security Advisory : xscreensaver (MDKSA-2007:097)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2008-0887

critical

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium