CVE-2014-3204: Medium severity Ayatana Project Unity vulnerability
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by right-clicking on the indicator bar and then pressing the ALT and F2 keys.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Unity before 7.2.1, including Unity as used in Ubuntu 14.04, are exposed. Exploitation requires an attacker to be physically proximate to an already locked system.
What access does an attacker need to bypass the lock screen?
The attacker does not need prior authentication, but must be able to interact with the machine locally. The demonstrated method uses the indicator bar context menu followed by the Alt+F2 keyboard shortcut to execute commands.
How can I determine whether a system is affected?
Check whether the system uses Unity and whether its Unity version is earlier than 7.2.1. Affected systems may allow commands to be launched from the lock screen through the indicator-bar and Alt+F2 shortcut sequence.