Executive Summary
| Summary | |
|---|---|
| Title | New gdm packages fix local root exploit |
| Informations | |||
|---|---|---|---|
| Name | DSA-1040 | First vendor Publication | 2006-04-24 |
| Vendor | Debian | Last vendor Modification | 2006-04-24 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:H/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 3.7 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | High |
| Cvss Expoit Score | 1.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability has been identified in gdm, a display manager for X, that could allow a local attacker to gain elevated privileges by exploiting a race condition in the handling of the .ICEauthority file. The old stable distribution (woody) is not affected by this problem. For the stable distribution (sarge) this problem has been fixed in version 2.6.0.8-1sarge2. For the unstable distribution (sid) this problem will be fixed in version 2.14.1-1. We recommend that you upgrade your gdm package. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1040 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-362 | Race Condition |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10092 | |||
| Oval ID: | oval:org.mitre.oval:def:10092 | ||
| Title: | Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file. | ||
| Description: | Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-1057 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 1040-1 (gdm) File : nvt/deb_1040_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 31652 | gdm slave.c Symlink Race Condition |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0286.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070501_gdm_on_SL4.nasl - Type : ACT_GATHER_INFO |
| 2007-05-02 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0286.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1040.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-083.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-278-1.nasl - Type : ACT_GATHER_INFO |
| 2006-04-21 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-338.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:25:42 |
|
