4.6

CVE-2007-1859

XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xscreensaver ≫ Xscreensaver Version 4.10
   Redhat ≫ Enterprise Linux Version 2.1 Edition advanced_server
   Redhat ≫ Enterprise Linux Version 2.1 Edition enterprise_server
   Redhat ≫ Enterprise Linux Version 2.1 Edition workstation
   Redhat ≫ Enterprise Linux Version 3.0 Edition advanced_servers
   Redhat ≫ Enterprise Linux Version 3.0 Edition enterprise_server
   Redhat ≫ Enterprise Linux Version 3.0 Edition workstation
   Redhat ≫ Enterprise Linux Version 4.0 Edition advanced_server
   Redhat ≫ Enterprise Linux Version 4.0 Edition enterprise_server
   Redhat ≫ Enterprise Linux Version 4.0 Edition workstation
   Redhat ≫ Enterprise Linux Desktop Version 3.0
   Redhat ≫ Enterprise Linux Desktop Version 4.0
   Redhat ≫ Linux Advanced Workstation Version 2.1 Edition itanium
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.328
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://secunia.com/advisories/25119
Vendor Advisory
http://www.novell.com/linux/security/advisories/2007_9_sr.html
http://osvdb.org/35531
http://secunia.com/advisories/25065
Vendor Advisory
http://secunia.com/advisories/25105
Vendor Advisory
http://secunia.com/advisories/25116
Vendor Advisory
http://secunia.com/advisories/25118
Vendor Advisory
http://secunia.com/advisories/25225
Vendor Advisory
http://secunia.com/advisories/25610
http://security.gentoo.org/glsa/glsa-200705-14.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:097
http://www.redhat.com/support/errata/RHSA-2007-0322.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/23783
http://www.securitytracker.com/id?1017996
http://www.ubuntu.com/usn/usn-474-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/34054
https://issues.rpath.com/browse/RPL-1293
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11459