The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts, a related issue to CVE-2007-3920.

The expo plugin in Compiz Fusion allowed local users with physical access to bypass the screen-saver by just dragging it aside.
(CVE-2008-6514: CVSS v2 Base Score: 6.2). This has been fixed.

The expo plugin in Compiz Fusion allowed local users with physical access to bypass the screen-saver by just dragging it aside.
(CVE-2008-6514: CVSS v2 Base Score: 6.2)

A vulnerability has been found and corrected in compiz-fusion-plugins-main :

The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts, a related issue to CVE-2007-3920 (CVE-2008-6514).

This update fixes this vulnerability.

It was discovered that the Expo plugin for Compiz did not correctly restrict the screensaver window from being moved with the mouse. A local attacker could use the mouse to move the screensaver off the screen and gain access to the locked desktop session underneath.
Default installs of Ubuntu were not vulnerable as Expo does not come pre-configured with mouse bindings.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a security issue in the expo plugin which allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
50487	SuSE 11 Security Update : compiz (SAT Patch Number 2005)	Nessus	SuSE Local Security Checks	medium
45353	openSUSE Security Update : compiz-fusion-plugins-main (compiz-fusion-plugins-main-1990)	Nessus	SuSE Local Security Checks	medium
45351	openSUSE Security Update : compiz-fusion-plugins-main (compiz-fusion-plugins-main-1990)	Nessus	SuSE Local Security Checks	medium
45349	openSUSE Security Update : compiz-fusion-plugins-main (compiz-fusion-plugins-main-1990)	Nessus	SuSE Local Security Checks	medium
42133	Mandriva Linux Security Advisory : compiz-fusion-plugins-main (MDVSA-2009:278)	Nessus	Mandriva Local Security Checks	medium
37422	Ubuntu 7.10 / 8.04 LTS / 8.10 : compiz-fusion-plugins-main vulnerability (USN-688-1)	Nessus	Ubuntu Local Security Checks	medium
37306	Fedora 10 : compiz-fusion-0.7.8-4.fc10 (2009-2986)	Nessus	Fedora Local Security Checks	medium
36023	Fedora 9 : compiz-fusion-0.7.6-6.fc9 (2009-3003)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-6514

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium