CVE-2010-0285: Medium severity Gnome screensaver vulnerability
gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when the X configuration enables the extend screen option, allows physically proximate attackers to bypass screen locking, access an unattended workstation, and view half of the GNOME desktop by attaching an external monitor.
Other sources
It was reported [1] that the GNOME screensaver could insecurely unlock a secondary screen when moving from a single screen display to a dual-screen display. If a user were to have a suspended laptop, attach an external monitor, resume, and attempt to unlock the GNOME screensaver, the external display will show the GNOME desktop and can be interacted with, without requiring a password.
Upstream has provided a possible patch to correct the issue [2].
CVE-2010-0285 has been assigned to this issue.
[1] https://bugzilla.gnome.org/showbug.cgi?id=593616 [2] http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0285?
CVE-2010-0285 has been classified as a medium severity vulnerability due to the potential for unauthorized access to unattended workstations.
How do I fix CVE-2010-0285?
To fix CVE-2010-0285, users should disable the extend screen option in their X configuration or upgrade to a patched version of GNOME screensaver.
What versions of GNOME screensaver are affected by CVE-2010-0285?
The affected versions of GNOME screensaver include 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3.
What can attackers achieve by exploiting CVE-2010-0285?
Attackers can bypass screen locking and access half of the GNOME desktop by attaching an external monitor.
Is physical proximity required to exploit CVE-2010-0285?
Yes, physical proximity is required as the attacker needs access to the workstation.