The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0777 advisory.

    [2.16.0-31.0.1]
     - CVE-2007-3381      Resolves: #247659

     [2.16.0-31]
     - change 200d character to 200c character in ml.po

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way Gdm listens on its unix domain socket. A local user could crash a running X session by writing malicious data to Gdm's unix domain socket. (CVE-2007-3381)

JLANTHEA reported a denial of service flaw in the way that gdm listens on its unix domain socket. Any local user can crash the locally running X session.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-11 (GDM: Local Denial of Service)

    The result of a g_strsplit() call is incorrectly parsed in the files     daemon/gdm.c, daemon/gdmconfig.c, gui/gdmconfig.c and     gui/gdmflexiserver.c, allowing for a NULL pointer dereference.
  Impact :

    A local user could send a crafted message to /tmp/.gdm_socket that     would trigger the NULL pointer dereference and crash GDM, thus     preventing it from managing future displays.
  Workaround :

    Restrict the write permissions on /tmp/.gdm_socket to trusted users     only after each GDM restart.

A vulnerability was discovered in how gdm listens on its unix domain socket. A local user could crash a running X session by writing malicious data to gdm's unix domain socket.

Updated packages have been patched to prevent this issue.

An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Gdm (the GNOME Display Manager) is a highly configurable reimplementation of xdm, the X Display Manager. Gdm allows you to log into your system with the X Window System running and supports running several different X sessions on your local machine at the same time.

A flaw was found in the way Gdm listens on its unix domain socket. A local user could crash a running X session by writing malicious data to Gdm's unix domain socket. (CVE-2007-3381)

All users of gdm should upgrade to this updated package, which contains a backported patch that resolves this issue.

Red Hat would like to thank JLANTHEA for reporting this issue.

ID	Name	Product	Family	Severity
67557	Oracle Linux 5 : Moderate: / gdm (ELSA-2007-0777)	Nessus	Oracle Linux Local Security Checks	high
60239	Scientific Linux Security Update : gdm on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
27712	Fedora 7 : gdm-2.18.4-1.fc7 (2007-1362)	Nessus	Fedora Local Security Checks	low
26101	GLSA-200709-11 : GDM: Local Denial of Service	Nessus	Gentoo Local Security Checks	low
25946	Mandrake Linux Security Advisory : gdm (MDKSA-2007:169)	Nessus	Mandriva Local Security Checks	low
25878	RHEL 5 : gdm (RHSA-2007:0777)	Nessus	Red Hat Local Security Checks	low
25850	CentOS 5 : gdm (CESA-2007:0777)	Nessus	CentOS Local Security Checks	low

Detections

Analytics

CVE-2007-3381

high

Tenable Plugins

high

low

low

low

low

low

low