CVE - CVE-2007-1859

CVE-ID
CVE-2007-1859	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:23783 URL:http://www.securityfocus.com/bid/23783 CONFIRM:https://issues.rpath.com/browse/RPL-1293 GENTOO:GLSA-200705-14 URL:http://security.gentoo.org/glsa/glsa-200705-14.xml MANDRIVA:MDKSA-2007:097 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:097 OSVDB:35531 URL:http://osvdb.org/35531 OVAL:oval:org.mitre.oval:def:11459 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11459 REDHAT:RHSA-2007:0322 URL:http://www.redhat.com/support/errata/RHSA-2007-0322.html SECTRACK:1017996 URL:http://www.securitytracker.com/id?1017996 SECUNIA:25065 URL:http://secunia.com/advisories/25065 SECUNIA:25105 URL:http://secunia.com/advisories/25105 SECUNIA:25116 URL:http://secunia.com/advisories/25116 SECUNIA:25118 URL:http://secunia.com/advisories/25118 SECUNIA:25119 URL:http://secunia.com/advisories/25119 SECUNIA:25225 URL:http://secunia.com/advisories/25225 SECUNIA:25610 URL:http://secunia.com/advisories/25610 SUSE:SUSE-SR:2007:009 URL:http://www.novell.com/linux/security/advisories/2007_9_sr.html UBUNTU:USN-474-1 URL:http://www.ubuntu.com/usn/usn-474-1 XF:xscreensaver-getpwuid-authentication-bypass(34054) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/34054
Assigning CNA
Red Hat, Inc.
Date Record Created
20070404	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070404)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)