Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Gentoo: 201201-16 Normal: X.Org Screen Lock Bypass Threat

gentoo
Calendar Grey January 27, 2012
Dist Gentoo Esm H88
X.Org X Server notice regarding shortcut vulnerability, allowing unapproved entry to secured screens. Risk Level: Moderate.
A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities

Summary

Starting with the =x11-base/xorg-server-1.11 package, the X.Org X Server again provides debugging functionality that can be used terminate an application that exclusively grabs mouse and keyboard input, like screen locking utilities. Gu1 reported that the X Keyboard Configuration Database maps this functionality by default to the Ctrl+Alt+Numpad * key combination.

Topics%20covered

Topics Covered

security advisory gentoo access control xorg normal severity screen lock keyboard issue

Resolution

References

[ 1 ] CVE-2012-0064 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0064

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201201-16
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: X.Org X Server/X Keyboard Configuration Database: Screen lock
Date: January 27, 2012
Bugs: #399347
ID: 201201-16

Topics%20covered

Topics Covered

security advisory gentoo access control xorg normal severity screen lock keyboard issue

Synopsis

A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities.

Background

The X Keyboard Configuration Database provides keyboard configuration for various X server implementations.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-misc/xkeyboard-config < 2.4.1-r3 >= 2.4.1-r3 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: amd64, arm, hppa, x86

Impact

===== A physically proximate attacker could exploit this vulnerability to gain access to a locked X session without providing the correct credentials.

Workaround

Downgrade to any version of x11-base/xorg-server below x11-base/xorg-server-1.11: # emerge --oneshot --verbose "=x11-misc/xkeyboard-config-2.4.1-r3"
NOTE: The X.Org X Server 1.11 was only stable on the AMD64, ARM, HPPA, and x86 architectures. Users of the stable branches of all other architectures are not affected and will be directly provided with a fixed X Keyboard Configuration Database version.

Your message here