Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2007-4569 | First vendor Publication | 2007-09-21 |
| Vendor | Cve | Last vendor Modification | 2017-09-29 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.1 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4569 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10359 | |||
| Oval ID: | oval:org.mitre.oval:def:10359 | ||
| Title: | backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors. | ||
| Description: | backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-4569 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17472 | |||
| Oval ID: | oval:org.mitre.oval:def:17472 | ||
| Title: | USN-517-1 -- kdebase vulnerability | ||
| Description: | It was discovered that KDM would allow logins without password checks under certain circumstances. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-517-1 CVE-2007-4569 | Version: | 5 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | kdebase |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18533 | |||
| Oval ID: | oval:org.mitre.oval:def:18533 | ||
| Title: | DSA-1376-1 kdebase - programming error | ||
| Description: | iKees Huijgen discovered that under certain circumstances KDM, an X session manager for KDE, could be tricked into allowing user logins without a password. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1376-1 CVE-2007-4569 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | kdebase |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-04-09 | Name : Mandriva Update for kdebase MDKSA-2007:190 (kdebase) File : nvt/gb_mandriva_MDKSA_2007_190.nasl |
| 2009-03-23 | Name : Ubuntu Update for kdebase vulnerability USN-517-1 File : nvt/gb_ubuntu_USN_517_1.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-2361 File : nvt/gb_fedora_2007_2361_kdebase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-716 File : nvt/gb_fedora_2007_716_kdebase_fc6.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200710-15 (KDM) File : nvt/glsa_200710_15.nasl |
| 2008-09-04 | Name : FreeBSD Ports: kdebase3 File : nvt/freebsd_kdebase30.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1376-1 (kdebase) File : nvt/deb_1376_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-264-01 kdebase, kdelibs File : nvt/esoft_slk_ssa_2007_264_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 41394 | KDE KDM backend/session.c Login Password Check Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071008_kdebase_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fileshareset-4433.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-517-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2361.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_fileshareset-4454.nasl - Type : ACT_GATHER_INFO |
| 2007-10-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200710-15.nasl - Type : ACT_GATHER_INFO |
| 2007-10-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2007-716.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2007-10-03 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-190.nasl - Type : ACT_GATHER_INFO |
| 2007-09-24 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-264-01.nasl - Type : ACT_GATHER_INFO |
| 2007-09-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1376.nasl - Type : ACT_GATHER_INFO |
| 2007-09-24 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_79b616d066d111dcb25f02e0185f8d72.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:06:19 |
|
| 2021-04-22 01:06:51 |
|
| 2020-05-23 00:20:21 |
|
| 2017-09-29 09:23:11 |
|
| 2017-07-29 12:02:29 |
|
| 2016-04-26 16:32:08 |
|
| 2014-02-17 10:41:27 |
|
| 2013-05-11 10:35:07 |
|
