Executive Summary
| Summary | |
|---|---|
| Title | New kdebase packages fix authentication bypass |
| Informations | |||
|---|---|---|---|
| Name | DSA-660 | First vendor Publication | 2005-01-26 |
| Vendor | Debian | Last vendor Modification | 2005-01-26 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Raphaël Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session. For the stable distribution (woody) this problem has been fixed in version 2.2.2-14.9. This problem has been fixed upstream in KDE 3.0.5 and is therefore fixed in the unstable (sid) and testing (sarge) distributions already. We recommend that you upgrade your kscreensaver package. |
Original Source
| Url : http://www.debian.org/security/2005/dsa-660 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:9260 | |||
| Oval ID: | oval:org.mitre.oval:def:9260 | ||
| Title: | Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. | ||
| Description: | The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0078 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 660-1 (kdebse) File : nvt/deb_660_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13204 | KDE Screensaver Crash Local Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2005-02-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-009.nasl - Type : ACT_GATHER_INFO |
| 2005-01-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-660.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:50 |
|
