LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session.

- lightdm-1.24.0

  - Disable guest login as system default preset     (CVE-2017-8900)

  - Modernize spec-file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Disable guest login as system default preset     (CVE-2017-8900)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tyler Hicks discovered that LightDM did not confine the user session for guest users. An attacker with physical access could use this issue to access files and other resources that they should not be able to access. In the default installation, this includes files in the home directories of other users on the system. This update fixes the issue by disabling the guest session. It may be re-enabled in a future update. Please see the bug referenced below for instructions on how to manually re-enable the guest session.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
105821	Fedora 27 : lightdm (2017-159a1060f6)	Nessus	Fedora Local Security Checks	medium
103236	Fedora 26 : lightdm (2017-d793fef58f)	Nessus	Fedora Local Security Checks	medium
103232	Fedora 25 : lightdm (2017-66adafeb3b)	Nessus	Fedora Local Security Checks	medium
100156	Ubuntu 16.10 / 17.04 : lightdm vulnerability (USN-3285-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2017-8900

medium

Tenable Plugins

medium

medium

medium

medium