CVE-2012-1620: Low severity Suckless Slock vulnerability
https://bugs.gentoo.org/showbug.cgi?id=401645
Jeroen Roovers 2012-01-31 17:23:28 UTC
1) In a terminal, I run slock & sleep 5; <some X app>' 2) After about 10 seconds, I press some keys that slock would interpret as a password. 3a) It does not allow me to use <some X app> - all keyboard controls are captured. 3b) Pointer device input is blocked - <some X app> cannot be controlled through the mouse. 4) Entering the correct password unlocks the screen and makes <some X app> focused and in the foreground.
The only harm I see here is a possible unwanted disclosure of the information that <some X app> happens to display at the time, but it's a vulnerability sure enough.
Other sources
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1620?
CVE-2012-1620 is classified as a high-severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2012-1620?
To fix CVE-2012-1620, update slock to a version newer than 0.9 that addresses this security issue.
Who is affected by CVE-2012-1620?
Users running slock version 0.9 are affected by CVE-2012-1620.
What types of systems are vulnerable to CVE-2012-1620?
Linux systems that utilize slock version 0.9 are vulnerable to CVE-2012-1620.
What exploits exist for CVE-2012-1620?
Exploits for CVE-2012-1620 can allow an attacker to bypass the lock screen through crafted input.