REDHAT-BUG-1050745: Low severity suse gdm vulnerability

Published Jan 9, 2014

Updated

It was reported [1],[2] that when the fallback greeter is used in GDM3.x, if the disable-user-list setting is "true" (so a user list is not displayed, but entry fields for username and password), if a user enters their username and are then presented with a password prompt, if they were to click the "cancel" button then all of the user-interactive fields disappear. The user is then unable to login in or otherwise interact with the display manager, and must either kill X or reboot.

There is no upstream fix as of yet. CVE-2013-7273 was assigned [3] to this issue.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683338 [2] https://bugzilla.gnome.org/showbug.cgi?id=704284 [3] http://seclists.org/oss-sec/2014/q1/40

Affected Software

1 affected component

Gnome gdm>=3.x

Event History

Jan 9, 2014

Data Sourced

01:22 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1050745?

The severity of REDHAT-BUG-1050745 is classified as moderate.

How do I fix REDHAT-BUG-1050745?

To fix REDHAT-BUG-1050745, update your GNOME GDM to a patched version that resolves this issue.

What does REDHAT-BUG-1050745 affect?

REDHAT-BUG-1050745 affects versions of GNOME GDM 3.x.

What is the nature of the vulnerability in REDHAT-BUG-1050745?

The vulnerability in REDHAT-BUG-1050745 involves mishandling user input during the login process.

Is there a workaround for REDHAT-BUG-1050745?

A temporary workaround for REDHAT-BUG-1050745 is to disable the fallback greeter in GDM.