The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.

- Add fix-CVE-2013-4509-support-input-purpose.patch

  - Fixed password is visible on GNOME lock screen     (bnc#847718, CVE-2013-4509)

This update fixes the following issue with ibus-pinyin :

  - Fix visible password entry in GNOME lock screen     (CVE-2013-4509, bnc#847718)

- This is an additional fix patch for ibus to avoid the wrong IBus.InputPurpose.PASSWORD advertisement, which leads to the password text appearance on GNOME3 lockscreen (bnc#847718)

- Resolves Bug 1054937 - Broken %defattr in ibus-chewing

    - Fix Build for RHEL7

    - Resolves Bug 1013977 - ibus-chewing needs to have ibus       write-cache --system in %post and %postun

    - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [rhel-7.0]

    - Resolves Bug 1028911 - [zh_TW]'Chinese<->English'       switch does not work when clicking on the Chewing menu       list.

    - Resolves Bug 1045868 - ibus-chewing *again* not built       with $RPM_OPT_FLAGS

    - Option 'Sync between caps lock and IM': + Default of       is changed to 'disable', because the previous default       'keyboard' cause bug 1028911 for GNOME Shell. + Now       Sync from 'input method' can control Caps LED in GNOME       shell.

  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA

    - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing       log.

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 1013977 - ibus-chewing needs to have ibus       write-cache --system in %post and %postun

    - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [rhel-7.0]

    - Resolves Bug 1028911 - [zh_TW]'Chinese<->English'       switch does not work when clicking on the Chewing menu       list.

    - Resolves Bug 1045868 - ibus-chewing *again* not built       with $RPM_OPT_FLAGS

    - Option 'Sync between caps lock and IM': + Default of       is changed to 'disable', because the previous default       'keyboard' cause bug 1028911 for GNOME Shell. + Now       Sync from 'input method' can control Caps LED in GNOME       shell.

  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA

    - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing       log.

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Fix Build for RHEL7

    - Resolves Bug 1013977 - ibus-chewing needs to have ibus       write-cache --system in %post and %postun

    - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [rhel-7.0]

    - Resolves Bug 1028911 - [zh_TW]'Chinese<->English'       switch does not work when clicking on the Chewing menu       list.

    - Resolves Bug 1045868 - ibus-chewing *again* not built       with $RPM_OPT_FLAGS

    - Option 'Sync between caps lock and IM': + Default of       is changed to 'disable', because the previous default       'keyboard' cause bug 1028911 for GNOME Shell. + Now       Sync from 'input method' can control Caps LED in GNOME       shell.

  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA

    - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing       log.

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 1013977 - ibus-chewing needs to have ibus       write-cache --system in %post and %postun

    - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [rhel-7.0]

    - Resolves Bug 1028911 - [zh_TW]'Chinese<->English'       switch does not work when clicking on the Chewing menu       list.

    - Resolves Bug 1045868 - ibus-chewing *again* not built       with $RPM_OPT_FLAGS

    - Option 'Sync between caps lock and IM': + Default of       is changed to 'disable', because the previous default       'keyboard' cause bug 1028911 for GNOME Shell. + Now       Sync from 'input method' can control Caps LED in GNOME       shell.

  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA

    - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing       log.

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

    - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built       with $RPM_OPT_FLAGS

    - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing:
      ibus: visible password entry flaw [fedora-all] Thanks       czchen for the GitHub pull request 39.

  - Added translations: fr_FR, ja_JP, ko_KR

    - Adopt cmake-fedora-1.2.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes ibus: visible password entry flaw. (rhbz#1027029) (CVE-2013-4509)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75382	openSUSE Security Update : ibus-chewing (openSUSE-SU-2014:0068-1)	Nessus	SuSE Local Security Checks	low
75220	openSUSE Security Update : ibus-pinyin (openSUSE-SU-2013:1825-1)	Nessus	SuSE Local Security Checks	low
75199	openSUSE Security Update : ibus (openSUSE-SU-2013:1686-1)	Nessus	SuSE Local Security Checks	low
72648	Fedora 19 : ibus-chewing-1.4.10.1-1.fc19 (2014-1910)	Nessus	Fedora Local Security Checks	low
72448	Fedora 20 : ibus-chewing-1.4.10.1-1.fc20 (2014-1908)	Nessus	Fedora Local Security Checks	low
70957	Fedora 19 : ibus-pinyin-1.5.0-5.fc19 (2013-20993)	Nessus	Fedora Local Security Checks	low
70910	Fedora 20 : ibus-pinyin-1.5.0-5.fc20 (2013-20929)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-4509

critical

Tenable Plugins

low

low

low

low

low

low

low