CVE-2013-4509: Low severity ibus vulnerability
It was reported [1] that IBUS 1.5.4 (and possibly 1.5.2) do not properly obscure password entry if a special "intent" is not provided.
A fix in ibus-anthy [2] illustrates what is necessary to provide the input purpose for the gnome-shell password dialog. A similar patch exists for ibus-mozc [3].
The SUSE bug report notes the following engines are affected:
ibus-mozc ibus-anthy (upstream 1.5.4 is fixed; in current Fedora) ibus-pinyin ibus-chewing
The vulnerability is in these engines due to the changes in IBUS, so it only affects these engines when IBUS >= 1.5.4 (or 1.5.2, it hasn't been determine precisely from what I can see) and GNOME 3.6+ are used together.
[1] https://bugzilla.novell.com/showbug.cgi?id=847718 [2] https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a5edfe7 [3] https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozcsupportibus-1.5.4rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690
Other sources
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4509?
CVE-2013-4509 has a medium severity rating due to improper obscuring of password input.
How do I fix CVE-2013-4509?
To fix CVE-2013-4509, update iBus to versions 1.5.4 or higher where the password input obscuring issue is addressed.
Which software versions are affected by CVE-2013-4509?
CVE-2013-4509 affects iBus versions 1.5.2 and 1.5.4 as well as openSUSE 13.1.
Is there a workaround for CVE-2013-4509?
A possible workaround for CVE-2013-4509 is to provide the appropriate input purpose for password dialogs.
What impact does CVE-2013-4509 have on users?
CVE-2013-4509 may expose sensitive passwords if the input is not properly obscured, leading to potential security risks.