XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer     overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication     mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
    (CVE-2021-34557)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2642-1 advisory.

  - XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer     overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication     mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
    (CVE-2021-34557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2641-1 advisory.

  - XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer     overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication     mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
    (CVE-2021-34557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259426	Linux Distros Unpatched Vulnerability : CVE-2021-34557	Nessus	Misc.	medium
163804	SUSE SLES12 Security Update : xscreensaver (SUSE-SU-2022:2642-1)	Nessus	SuSE Local Security Checks	medium
163799	SUSE SLED15 / SLES15 Security Update : xscreensaver (SUSE-SU-2022:2641-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-34557

medium

Tenable Plugins

medium

medium

medium