XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.

From Red Hat Security Advisory 2007:0322 :

An updated xscreensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XScreenSaver is a collection of screensavers.

Alex Yamauchi discovered a flaw in the way XScreenSaver verifies user passwords. When a system is using a remote directory service for login credentials, a local attacker may be able to cause a network outage causing XScreenSaver to crash, unlocking the screen. (CVE-2007-1859)

Users of XScreenSaver should upgrade to this updated package, which contains a backported patch to correct this issue.

Alex Yamauchi discovered a flaw in the way XScreenSaver verifies user passwords. When a system is using a remote directory service for login credentials, a local attacker may be able to cause a network outage causing XScreenSaver to crash, unlocking the screen. (CVE-2007-1859)

Xscreensaver could crash under certain circumstances causing the screen to unlock. That could happen for example when LDAP is used for authentication and the network connection gets interrupted for a long time. (CVE-2007-1859)

xscreensaver could crash under certain circumstances causing the screen to unlock. That could happen for example when LDAP is used for authentication and the network connection gets interrupted for a long time. (CVE-2007-1859)

It was discovered that xscreensaver did not correctly validate the return values from network authentication systems such as LDAP or NIS.
A local attacker could bypass a locked screen if they were able to interrupt network connectivity.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xscreensaver could crash under certain circumstances and so cause unlocking the screen. That could happen for example when LDAP is used for authentication and the network connection gets interrupted for a long time (CVE-2007-1859).

The remote host is affected by the vulnerability described in GLSA-200705-14 (XScreenSaver: Privilege escalation)

    XScreenSaver incorrectly handles the results of the getpwuid() function     in drivers/lock.c when using directory servers during a network outage.
  Impact :

    A local user can crash XScreenSaver by preventing network connectivity     if the system uses a remote directory service for credentials such as     NIS or LDAP, which will unlock the screen.
  Workaround :

    There is no known workaround at this time.

An updated xscreensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XScreenSaver is a collection of screensavers.

Alex Yamauchi discovered a flaw in the way XScreenSaver verifies user passwords. When a system is using a remote directory service for login credentials, a local attacker may be able to cause a network outage causing XScreenSaver to crash, unlocking the screen. (CVE-2007-1859)

Users of XScreenSaver should upgrade to this updated package, which contains a backported patch to correct this issue.

A problem with the way xscreensaver verifies user passwords was discovered by Alex Yamauchi. When a system is using remote authentication (i.e. LDAP) for logins, a local attacker able to cause a network outage on the system could cause xscreensaver to crash, which would unlock the screen.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
67485	Oracle Linux 3 / 4 : xscreensaver (ELSA-2007-0322)	Nessus	Oracle Linux Local Security Checks	medium
60175	Scientific Linux Security Update : xscreensaver on SL4 i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60174	Scientific Linux Security Update : xscreensaver on SL3.0.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41131	SuSE9 Security Update : xscreensaver (YOU Patch Number 11506)	Nessus	SuSE Local Security Checks	medium
29611	SuSE 10 Security Update : xscreensaver (ZYPP Patch Number 3241)	Nessus	SuSE Local Security Checks	medium
28075	Ubuntu 6.06 LTS / 6.10 / 7.04 : xscreensaver vulnerability (USN-474-1)	Nessus	Ubuntu Local Security Checks	medium
27500	openSUSE 10 Security Update : xscreensaver (xscreensaver-3240)	Nessus	SuSE Local Security Checks	medium
25235	GLSA-200705-14 : XScreenSaver: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
25158	RHEL 2.1 / 3 / 4 : xscreensaver (RHSA-2007:0322)	Nessus	Red Hat Local Security Checks	medium
25157	Mandrake Linux Security Advisory : xscreensaver (MDKSA-2007:097)	Nessus	Mandriva Local Security Checks	medium
25150	CentOS 3 : xscreensaver (CESA-2007:0322)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-1859

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium