A vulnerability has been identified in gdm, a display manager for X, that could allow a local attacker to gain elevated privileges by exploiting a race condition in the handling of the .ICEauthority file.

From Red Hat Security Advisory 2007:0286 :

An updated gdm package that fixes a security issue and a bug is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Gdm (the GNOME Display Manager) is a highly configurable reimplementation of xdm, the X Display Manager. Gdm allows you to log into your system with the X Window System running and supports running several different X sessions on your local machine at the same time.

Marcus Meissner discovered a race condition issue in the way Gdm modifies the permissions on the .ICEauthority file. A local attacker could exploit this flaw to gain privileges. Due to the nature of the flaw, however, a successful exploitation was unlikely. (CVE-2006-1057)

This erratum also includes a bug fix to correct the pam configuration for the audit system.

All users of gdm should upgrade to this updated package, which contains backported patches to resolve these issues.

Marcus Meissner 氏が、Gdm が、.ICEauthority ファイルの権限を変更する方法で競合状態を発見しました。ローカルの攻撃者が、この欠陥を悪用して権限を取得する可能性があります。ただし、欠陥の特性により、悪用に成功する確率は高くありません。（CVE-2006-1057）

(Notes taken from upstream release mail)

  - The sockets connection between the slaves and the GDM     daemon is now better managed to better ensure that     sockets are never left open. (Brian Cameron)

  - Corrected bug that causes a core dump when you click on     gdmgreeter fields that have an id. (Brian Cameron)

  - Add new GdmXserverTimeout configuration setting so that     the length of time GDM waits for the Xserver to start     can be tuned, so GDM better works with Xservers that     require more than 10 seconds to start. (Emilie)

  - The happygnome and happygnome-list gdmgreeter themes now     use the official logo. (Brian Cameron)

  - Now GDM configure supports --with-sysconfsubdir so that     GDM's configuration directory can be configured to not     have '/gdm' appended to the end.

  - Fix for ensuring .ICEauthority file has proper     ownership/permissions. Addresses CVE-2006-1057. (Hans     Petter Jansson)

  - Fix 'Show Actions Menu' section in gdmsetup so it     appears when both 'Plain' and 'Themed' style is chosen.
    (Brian Cameron, Dennis Cranston)

  - Now use LINGUAS procedure for defining languages.
    (Michiel Sikkes)

  - Now Xsession script uses '$@' instead of '$1' so it is     possible to pass arguments with the command to run.
    (Brian Cameron)

  - Add Trusted Solraris support. (Niall Power)

  - One line fix to Solaris auditing logic that fixes a bug     causing authentication to fail when auditing is turned     on. (Brian Cameron)

  - Fixes to compile with C99 and fixes to compile under     NetBSD. Remove EXPANDED_* variables from the configure.
    (Julio M. Merino Vidal)

  - Translation updates (Aygimantas Beruaka, Benoat Dejean,     Laurent Dhima, Maxim Dziumanenko, Alessio Frusciante,     Rhys Jones, Raphael Higino, Theppitak Karoonboonyanan,     Gabor Kelmen, Priit Laes, Jordi Mallach, Kjartan Maraas,     Daniel Nylander, Kostas Papdimas, Guilherme de S.
    Pastore, Ankit Patel, Ignacio Casal Quinteiro, Hendrik     Richter, Jens Seidel, Francisco Javier F. Serrador,     Alexander Shopov, Clytie Siddall, Ilkka Tuohela, Vincent     van Adrighem, Tommi Vainikaninen)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Red Hat セキュリティアドバイザリ 2007:0286 から：

セキュリティの問題とバグを修正する更新済みの gdm パッケージが、現在利用可能です。

この更新は、Red Hat セキュリティレスポンスチームによりセキュリティインパクトが小さいと評価されています。

GDM（GNOME Display Manager）は、XDM（X Display Manager）の高度な構成が可能な再実装です。GDM により、ユーザーは X Window System を実行しているシステムにログインできます。また GDM では、ローカルマシンでいくつかの異なる X セッションを同時に実行することも可能です。

Marcus Meissner 氏が、Gdm が、.ICEauthority ファイルの権限を変更する方法で競合状態を発見しました。ローカルの攻撃者が、この欠陥を悪用して権限を取得する可能性があります。ただし、欠陥の特性により、悪用に成功する確率は高くありません。(CVE-2006-1057)

またこのエラータには、監査システムに対する pam 構成を修正するバグ修正が含まれています。

gdm の全ユーザーは、バックポートされたパッチが含まれるこの更新済みパッケージへアップグレードし、これらの問題を解決する必要があります。

Marcus Meissner 发现在 Gdm 修改 .ICEauthority 文件中权限的方式中存在争用条件问题。本地攻击者可利用此缺陷获得权限。然而，由于缺陷的性质，漏洞利用不太可能成功。(CVE-2006-1057)

来自 Red Hat 安全公告 2007:0286：

更新后的 gdm 程序包修复了一个安全问题和一个缺陷，现在可用。

Red Hat 安全响应团队将此更新评级为具有低安全影响。

Gdm（GNOME 显示管理器）是 xdm（X 显示管理器）可高度配置的再实现。Gdm 允许您在 X Window System 运行时登录到系统中，并且支持在本地计算机上同时运行多个不同的 X 会话。

Marcus Meissner 发现在 Gdm 修改 .ICEauthority 文件中权限的方式中存在争用条件问题。本地攻击者可利用此缺陷获得权限。然而，由于缺陷的性质，漏洞利用不太可能成功。(CVE-2006-1057)

此勘误表还包含一个缺陷补丁，修正了审计系统的 pam 配置。

所有 gdm 用户都应升级此更新后的程序包，其中包含用于解决这些问题的向后移植的修补程序。

Marcus Meissner 在 Gdm 修改 .ICEauthority 檔案上之權限的方式中發現爭用情形問題。本機攻擊者可惡意利用此瑕疵取得權限。但是，由於此瑕疵的特性，不可能成功惡意利用。(CVE-2006-1057)

來自 Red Hat 安全性公告 2007:0286：

現已提供更新版 gdm 套件，可修正一個安全性問題和一個錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有低安全性影響。

Gdm (GNOME Display Manager) 是一項可供高度設定的 xdm (X Display Manager) 重新實作。Gdm 允許您在執行 X Window System 的情況下登入系統，並支援同時在您的本機機器上執行數個不同的 X 工作階段。

Marcus Meissner 在 Gdm 修改 .ICEauthority 檔案上之權限的方式中發現爭用情形問題。本機攻擊者可惡意利用此瑕疵取得權限。但是，由於此瑕疵的特性，不可能成功惡意利用。(CVE-2006-1057)

此錯字勘誤表也包含一個錯誤修正，可更正稽核系統的 pam 組態。

所有 gdm 使用者皆應升級至此更新版套件，其中包含多個可解決這些問題的反向移植修補程式。

Marcus Meissner discovered a race condition issue in the way Gdm modifies the permissions on the .ICEauthority file. A local attacker could exploit this flaw to gain privileges. Due to the nature of the flaw, however, a successful exploitation was unlikely. (CVE-2006-1057)

An updated gdm package that fixes a security issue and a bug is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Gdm (the GNOME Display Manager) is a highly configurable reimplementation of xdm, the X Display Manager. Gdm allows you to log into your system with the X Window System running and supports running several different X sessions on your local machine at the same time.

Marcus Meissner discovered a race condition issue in the way Gdm modifies the permissions on the .ICEauthority file. A local attacker could exploit this flaw to gain privileges. Due to the nature of the flaw, however, a successful exploitation was unlikely. (CVE-2006-1057)

This erratum also includes a bug fix to correct the pam configuration for the audit system.

All users of gdm should upgrade to this updated package, which contains backported patches to resolve these issues.

A race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.

Packages have been patched to correct this issue.

Marcus Meissner discovered a race condition in gdm's handling of the ~/.ICEauthority file permissions. A local attacker could exploit this to become the owner of an arbitrary file in the system. When getting control over automatically executed scripts (like cron jobs), the attacker could eventually leverage this flaw to execute arbitrary commands with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
22582	Debian DSA-1040-1 : gdm - programming error	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	low
67483	Oracle Linux 4 : gdm (ELSA-2007-0286)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60166	Scientific Linux セキュリティ更新：SL4 i386/x86_64 の gdm	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
21249	Fedora Core 5 : gdm-2.14.1-1.fc5.2 (2006-338)	Nessus	Fedora Local Security Checks	2006/4/21	2021/1/11	low
67483	Oracle Linux 4：gdm（ELSA-2007-0286）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60166	Scientific Linux 安全更新：SL4 i386/x86_64 中的 gdm	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67483	Oracle Linux 4：gdm (ELSA-2007-0286)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60166	Scientific Linux 安全性更新：SL4 i386/x86_64 上的 gdm	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67483	Oracle Linux 4 : gdm (ELSA-2007-0286)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60166	Scientific Linux Security Update : gdm on SL4 i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
25145	RHEL 4 : gdm (RHSA-2007:0286)	Nessus	Red Hat Local Security Checks	2007/5/2	2021/1/14	low
21358	Mandrake Linux Security Advisory : gdm (MDKSA-2006:083)	Nessus	Mandriva Local Security Checks	2006/5/13	2021/1/6	low
21372	Ubuntu 5.04 / 5.10 : gdm vulnerabilitiy (USN-278-1)	Nessus	Ubuntu Local Security Checks	2006/5/13	2021/1/19	low

偵測

搜尋 Plugin

low

low

low

low

low

low

low

low

low

low

low

low

low