gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when the X configuration enables the extend screen option, allows physically proximate attackers to bypass screen locking, access an unattended workstation, and view half of the GNOME desktop by attaching an external monitor.

- When resuming a system, gnome-screensaver does not lock     external displays that got connected while the system     was suspended. (CVE-2010-0285)

  - Pressing the 'Return' key repeatedly caused an X error     that terminated gnome-screensaver. (CVE-2010-0732)

It was discovered that gnome-screensaver did not correctly lock all screens when monitors get hotplugged. An attacker with physical access could use this flaw to gain access to a locked session.
(CVE-2010-0285)

It was discovered that gnome-screensaver did not correctly handle keyboard grab when monitors get hotplugged. An attacker with physical access could use this flaw to gain access to a locked session. This issue only affected Ubuntu 9.10. (CVE-2010-0422).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gnome-screensaver was updated to the stable release 2.28.3, fixing various bugs and security issues.

Following security issues have been fixed: When resuming a system gnome-screensaver does not lock external displays that got connected while the system was suspended (CVE-2010-0285: CVSS v2 Base Score:
5.6).

Additionally another bug in gnome-screensaver was fixed that allowed bypassing the unlock dialog by using a removable monitor.
(CVE-2010-0414: CVSS v2 Base Score: 6.2)

Pressing 'return' repeatedly caused a X error which terminated the lock and so allowed local users to access the underlying session. (no CVE yet)

CVE-2010-0422: gnome-screensaver can lose its keyboard grab when locked, exposing the system to intrusion by adding and removing monitors.

When resuming a system gnome-screensaver doesn't lock external displays that got connected while the system was suspended (CVE-2010-0285).

ID	Name	Product	Family	Severity
64151	SuSE 11 Security Update : GNOME screensaver (SAT Patch Number 2150)	Nessus	SuSE Local Security Checks	medium
45016	Ubuntu 8.10 / 9.04 / 9.10 : gnome-screensaver vulnerabilities (USN-907-1)	Nessus	Ubuntu Local Security Checks	medium
44622	openSUSE Security Update : gnome-screensaver (gnome-screensaver-1973)	Nessus	SuSE Local Security Checks	high
44617	openSUSE Security Update : gnome-screensaver (gnome-screensaver-1837)	Nessus	SuSE Local Security Checks	medium
44612	openSUSE Security Update : gnome-screensaver (gnome-screensaver-1837)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-0285

medium

Tenable Plugins

medium

medium

high

medium

medium