CVE-2014-3203: Medium severity Ayatana Project Unity vulnerability
Published May 6, 2014
·Updated
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is active, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by pressing the SUPER key before the screen auto-locks.
Affected Software
8 affected components
Ayatana Project Unity<=7.2.0
Ayatana Project Unity=7.0.0
Ayatana Project Unity=7.0.1
Ayatana Project Unity=7.1.0
Ayatana Project Unity=7.1.1
Ayatana Project Unity=7.1.2
Ayatana Project Unity=7.1.3
Ubuntu=14.04
Event History
May 6, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who is realistically exposed to this issue?
Systems using Unity before 7.2.1, including Unity as used in Ubuntu 14.04, are exposed when an attacker can physically access an active session.
2
What does an attacker need to exploit it?
The attacker needs physical proximity to the device and an opportunity to press the SUPER key before the screen auto-locks. No authentication is required.
3
What can an attacker do if exploitation succeeds?
An attacker can bypass the active lock screen through the Dash and execute arbitrary commands.