gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

- When resuming a system, gnome-screensaver does not lock     external displays that got connected while the system     was suspended. (CVE-2010-0285)

  - Pressing the 'Return' key repeatedly caused an X error     that terminated gnome-screensaver. (CVE-2010-0732)

A vulnerability was discovered and fixed in gtk+2.0 :

gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times (CVE-2010-0732).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update fixes this issue.

Pressing the 'Return' key repeatedly caused an X error that terminated gnome-screensaver (CVE-2010-0732).

ID	Name	Product	Family	Severity
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	critical
64151	SuSE 11 Security Update : GNOME screensaver (SAT Patch Number 2150)	Nessus	SuSE Local Security Checks	medium
46743	Mandriva Linux Security Advisory : gtk+2.0 (MDVSA-2010:109)	Nessus	Mandriva Local Security Checks	medium
45384	openSUSE Security Update : gnome-screensaver (gnome-screensaver-2152)	Nessus	SuSE Local Security Checks	medium
45383	openSUSE Security Update : gnome-screensaver (gnome-screensaver-2152)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-0732

medium

Tenable Plugins

critical

medium

medium

medium

medium