rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen.

An updated xscreensaver package that fixes two security flaws is now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XScreenSaver is a collection of screensavers.

A keyboard focus flaw was found in the way XScreenSaver prompts the user to enter their password to unlock the screen. XScreenSaver did not properly ensure it had proper keyboard focus, which could leak a users password to the program with keyboard focus. This behavior is not common, as only certain applications exhibit this focus error.
(CVE-2004-2655)

Several flaws were found in the way various XScreenSaver screensavers create temporary files. It may be possible for a local attacker to create a temporary file in way that could overwrite a different file to which the user running XScreenSaver has write permissions.
(CVE-2003-1294)

Users of XScreenSaver should upgrade to this updated package, which contains backported patches to correct these issues.

In some cases, xscreensaver did not properly grab the keyboard when reading the password for unlocking the screen, so that the password was typed into the currently active application window.

The only known vulnerable case was when xscreensaver activated while an rdesktop session was currently active.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
21902	CentOS 3 : xscreensaver (CESA-2006:0498)	Nessus	CentOS Local Security Checks	medium
21593	RHEL 2.1 / 3 : xscreensaver (RHSA-2006:0498)	Nessus	Red Hat Local Security Checks	medium
21216	Ubuntu 4.10 / 5.04 : xscreensaver vulnerability (USN-269-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2004-2655

critical

Tenable Plugins

medium

medium

medium