xkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by default, which allows physically proximate attackers to bypass an X screen lock via keyboard combinations that break the input grab.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by default, which
    allows physically proximate attackers to bypass an X screen lock via keyboard combinations that break the
    input grab. (CVE-2012-0064)

The remote host is affected by the vulnerability described in GLSA-201201-16 (X.Org X Server/X Keyboard Configuration Database: Screen lock bypass)

    Starting with the =x11-base/xorg-server-1.11 package, the X.Org X Server       again provides debugging functionality that can be used terminate an       application that exclusively grabs mouse and keyboard input, like screen       locking utilities.
    Gu1 reported that the X Keyboard Configuration Database maps this       functionality by default to the Ctrl+Alt+Numpad * key combination.
  Impact :

    A physically proximate attacker could exploit this vulnerability to gain       access to a locked X session without providing the correct credentials.
  Workaround :

    Downgrade to any version of x11-base/xorg-server below       x11-base/xorg-server-1.11:
      # emerge --oneshot --verbose '<x11-base/xorg-server-1.11'

Remove Ungrab/ClearGrab actions from the default keymap. This is a preventative update for xkeyboard-config to avoid triggering bug 783044 in the future. Fedora 15 currently does not ship an X server version that is affected by this bug.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The previous version of xkeyboard-config included the key combinations to clear and/or kill grabs in the default keymap. This enabled users to get around screen locks that use grabs to prevent input to other applications (e.g. gnome-screensaver). This update moves the definition of the key combinations to a XKB option that must be explicitly enabled by the user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401300	Alpine: multiple xkeyboard-config packages: security update to 2.4.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401300	Alpine: multiple xkeyboard-config packages: security update to 2.4.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
57722	GLSA-201201-16 : X.Org X Server/X Keyboard Configuration Database: Screen lock bypass	Nessus	Gentoo Local Security Checks	medium
57672	Fedora 15 : xkeyboard-config-2.3-3.fc15 (2012-0709)	Nessus	Fedora Local Security Checks	medium
57611	Fedora 16 : xkeyboard-config-2.3-3.fc16 (2012-0712)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0064

critical

Tenable Plugins

critical

critical

medium

medium

medium