drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Umgehung der Bildschirmsperre in X.Org
Name: |
Umgehung der Bildschirmsperre in X.Org |
|
ID: |
201201-16 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Fr, 27. Januar 2012, 23:38 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0064 |
|
Applikationen: |
X11 |
|
Originalnachricht |
--nextPart1730380.bKA0QACqZf Content-Type: Text/Plain; charset="us-ascii Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: X.Org X Server/X Keyboard Configuration Database: Screen lock bypass Date: January 27, 2012 Bugs: #399347 ID: 201201-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities.
Background ==========
The X Keyboard Configuration Database provides keyboard configuration for various X server implementations.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-misc/xkeyboard-config < 2.4.1-r3 >= 2.4.1-r3 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: amd64, arm, hppa, x86
Description ===========
Starting with the =x11-base/xorg-server-1.11 package, the X.Org X Server again provides debugging functionality that can be used terminate an application that exclusively grabs mouse and keyboard input, like screen locking utilities.
Gu1 reported that the X Keyboard Configuration Database maps this functionality by default to the Ctrl+Alt+Numpad * key combination.
Impact ======
A physically proximate attacker could exploit this vulnerability to gain access to a locked X session without providing the correct credentials.
Workaround ==========
Downgrade to any version of x11-base/xorg-server below x11-base/xorg-server-1.11:
# emerge --oneshot --verbose "<x11-base/xorg-server-1.11"
Resolution ==========
All xkeyboard-config users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=x11-misc/xkeyboard-config-2.4.1-r3"
NOTE: The X.Org X Server 1.11 was only stable on the AMD64, ARM, HPPA, and x86 architectures. Users of the stable branches of all other architectures are not affected and will be directly provided with a fixed X Keyboard Configuration Database version.
References ==========
[ 1 ] CVE-2012-0064 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0064
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-16.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--nextPart1730380.bKA0QACqZf Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (GNU/Linux)
iQIcBAABCAAGBQJPIx5VAAoJEDa6ZWES7jAAkCUQAKdAx2aVkQQi6+ilJK3lfdFy g4bH18qpFcof6Y6YKpa0NlbXy1IlxctbY//8FyQTl3gtZLtzyKH7sBhhCoO044kg XcO8F8wG6HzX0hA16+tEokaFmCTmk+ipvtOuelWzoKX4BwREu7D4e1DlqwvDK0Ma lpGTOQOB6bw6215gwiyHoDIwfq3Hu6M9jG8INQpRjFZ51AxS4wpYqwWUBlcCjfV5 Cxg8OeZg/rm0wiSK8SHI3B5pbBvEf/996sDHCjXzepQHfDvZ7Jnh95H6D0nmVjeR AgHPtbb3QKBMBYbBsAECfh5PiWdNzo1Zo43P870i4QHzP1Up+H1gXrPs3en0T3v8 mvrCFUjdT0N4icNuZfYE+C3WwCWE6z/7kok4qO/ryw07BevGWbI7nXvmLGF5LEDk i1hQ1POIKCc3eyUqnST69Wd2PzB5YKeiYf6EjAltfn3G1xb8IORYu0sKnBjyZHSh EpX6foc4/SLaJA8SbXomVo2cVkCwzkql/ozJCJyOStz10jEpLrySRw2MrdGgOI7+ qTlLxEZbwlig+VQbMTPyK5rvlmoGJyFWFYnGMlds+pWtswK3Q7MBoY4hZgs6cFHA vD2mzI/vpp7H089y9Fhjou7vPlvwQshdDGstMJMxv8+mqnnTsS/18bB7HEex9cQr 1FcncRUWAnsOqQ1yxet8 =uxCR -----END PGP SIGNATURE-----
--nextPart1730380.bKA0QACqZf--
|
|
|
|