Ubuntu update for GNOME Shell

1) Security restrictions bypass

EUVDB-ID: #VU17709

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3820

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a physical attacker to bypass security restrictions on the system.

The vulnerability exists due to the lock screen feature does not properly restrict all contextual actions. A physical attacker can click on the password text field to bypass the lock screen and re-enable certain keyboard shortcuts, which the attacker can use to perform unauthorized actions on the system.

Mitigation

Update the affected packages.

Ubuntu 18.10

gnome-shell - 3.30.2-0ubuntu1.18.10.2

Ubuntu 18.04 LTS

gnome-shell - 3.28.3+git20190124-0ubuntu18.04.2

Vulnerable software versions

gnome-shell (Ubuntu package): 3.28.3+git20190124-0ubuntu18.04.1 - 3.30.2-0ubuntu1.18.10.1

External links

http://usn.ubuntu.com/3966-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.