Description
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/25610 ↗
- http://secunia.com/advisories/25119 ↗
- http://secunia.com/advisories/25105 ↗
- http://secunia.com/advisories/25065 ↗
- http://secunia.com/advisories/25116 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11459 ↗
- http://secunia.com/advisories/25225 ↗
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:097 ↗
- http://www.novell.com/linux/security/advisories/2007_9_sr.html ↗
- https://issues.rpath.com/browse/RPL-1293 ↗
- http://osvdb.org/35531 ↗
- http://www.securityfocus.com/bid/23783 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34054 ↗
- http://www.redhat.com/support/errata/RHSA-2007-0322.html ↗
- http://secunia.com/advisories/25118 ↗
- http://www.securitytracker.com/id?1017996 ↗
- http://www.ubuntu.com/usn/usn-474-1 ↗
- http://security.gentoo.org/glsa/glsa-200705-14.xml ↗