SB2012122103 - Multiple vulnerabilities in GNOME Display Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012122103

SB2012122103 - Multiple vulnerabilities in GNOME Display Manager

Published: December 21, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012122103
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Link following (CVE-ID: CVE-2013-4169)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/.


2) Credentials management (CVE-ID: CVE-2010-2387)

CWE-ID: CWE-255 - Credentials Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.


Remediation

Install update from vendor's website.

References