The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gdm: use-after-free in the GDM daemon (CVE-2018-14424)

  - gdm3 3.14.2 and possibly later has an information leak before screen lock (CVE-2016-1000002)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the gdm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in gdm before 3.31.4.
    When timed login is enabled in configuration, an     attacker could bypass the lock screen by selecting the     timed login user and waiting for the timer to expire,     at which time they would gain access to the logged-in     user's session.(CVE-2019-3825)

  - The daemon in GDM through 3.29.1 does not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allows a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial     of service or potential code execution.(CVE-2018-14424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The daemon in GDM through 3.29.1 does not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allows a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial     of service or potential code execution.(CVE-2018-14424)

  - A vulnerability was discovered in gdm before 3.31.4.
    When timed login is enabled in configuration, an     attacker could bypass the lock screen by selecting the     timed login user and waiting for the timer to expire,     at which time they would gain access to the logged-in     user's session.(CVE-2019-3825)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gdm provides the following fixes :

This security issue was fixed :

  - CVE-2018-14424: The daemon in GDM did not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allowed a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial of     service or potential code execution (bsc#1103737)

These non-security issues were fixed :

  - Enable pam_keyinit module (bsc#1081947)

  - Fix a build race in SLE (bsc#1103093)

This update was imported from the SUSE:SLE-15:Update update project.

gdm 3.28.3 release, fixing CVE-2018-14424.

  - CVE-2018-14424 - double free fix

  - lifecycle fixes to libgdm/GdmClient

  - follow up fixes dealing with login screen reaping form     last release

  - allow pam modules to use SIGUSR1

  - set PWD for user session

  - tell cirrus not to use wayland

  - Translation updates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gdm provides the following fixes :

This security issue was fixed :

CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution (bsc#1103737)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The daemon in GDM does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution.

For Debian 8 'Jessie', this problem has been fixed in version 3.14.1-7+deb8u1.

We recommend that you upgrade your gdm3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gdm fixes the following security issue :

  - CVE-2018-14424: The daemon in GDM did not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allowed a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial of     service or potential code execution (bsc#1103737).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3737-1 advisory.

    A use-after-free was discovered in GDM. A local user could exploit this to cause a denial of service, or     potentially execute arbitrary code as the administrator.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chris Coulson discovered a use-after-free flaw in the GNOME Display Manager, triggerable by an unprivileged user via a specially crafted sequence of D-Bus method calls, leading to denial of service or potentially the execution of arbitrary code.

ID	Name	Product	Family	Severity
198599	RHEL 7 : gdm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195369	RHEL 7 : gdm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
149178	EulerOS 2.0 SP3 : gdm (EulerOS-SA-2021-1787)	Nessus	Huawei Local Security Checks	high
146754	EulerOS 2.0 SP2 : gdm (EulerOS-SA-2021-1297)	Nessus	Huawei Local Security Checks	high
144224	EulerOS 2.0 SP5 : gdm (EulerOS-SA-2020-2546)	Nessus	Huawei Local Security Checks	high
123308	openSUSE Security Update : gdm (openSUSE-2019-708)	Nessus	SuSE Local Security Checks	high
120483	Fedora 28 : 1:gdm (2018-6740c38cf4)	Nessus	Fedora Local Security Checks	high
120102	SUSE SLED15 / SLES15 Security Update : gdm (SUSE-SU-2018:2771-1)	Nessus	SuSE Local Security Checks	high
117685	openSUSE Security Update : gdm (openSUSE-2018-1037)	Nessus	SuSE Local Security Checks	high
117295	Debian DLA-1494-1 : gdm3 security update	Nessus	Debian Local Security Checks	high
112146	SUSE SLED12 / SLES12 Security Update : gdm (SUSE-SU-2018:2527-1)	Nessus	SuSE Local Security Checks	high
111673	Ubuntu 18.04 LTS : GDM vulnerability (USN-3737-1)	Nessus	Ubuntu Local Security Checks	high
111668	Debian DSA-4270-1 : gdm3 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-14424

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high