xlockmore before 5.43 'dclock' security bypass vulnerability

The remote host is affected by the vulnerability described in GLSA-201309-03 (Xlockmore: Denial of Service)

    A Denial of Service flaw was found in the way Xlockmore performed       the passing of arguments to the underlying localtime() call, when the       &lsquo;dlock&rsquo; mode was used.
  Impact :

    A local attacker could possibly cause a Denial of Service condition and       potentially obtain unauthorized access to the graphical session,       previously locked by another user.
  Workaround :

    There is no known workaround at this time.

fixed 'CVE-2012-4524 xlockmore: Screensaver crash (screen lock bypass) when 'dclock' mode used'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ignatios Souvatzis of NetBSD reports :

Due to an error in the dclock screensaver in xlockmore, users who explicitly use this screensaver or a random mix of screensavers using something like 'xlockmore -mode random' may have their screen unlocked unexpectedly at a random time.

ID	Name	Product	Family	Severity
69547	GLSA-201309-03 : Xlockmore: Denial of Service	Nessus	Gentoo Local Security Checks	high
62863	Fedora 18 : xlockmore-5.40-3.fc18 (2012-16454)	Nessus	Fedora Local Security Checks	medium
62823	Fedora 16 : xlockmore-5.40-3.fc16 (2012-16490)	Nessus	Fedora Local Security Checks	medium
62822	Fedora 17 : xlockmore-5.40-3.fc17 (2012-16485)	Nessus	Fedora Local Security Checks	medium
62611	FreeBSD : xlockmore -- local exploit (57652765-18aa-11e2-8382-00a0d181e71d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-4524

high

Tenable Plugins

high

medium

medium

medium

high