[email protected]CVE-2010-2387

HistoryDec 21, 2012 - 5:46 a.m.

CVE-2010-2387

2012-12-2105:46:00

CWE-255

[email protected]

web.nvd.nist.gov

gnome display manager

gdm

password logging

cve-2010-2387

security vulnerability

6.7 Medium

AI Score

Confidence

Low

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.

CPENameOperatorVersion
gnome:gnome_display_managergnome gnome display managereq2.20.8
gnome:gnome_display_managergnome gnome display managereq2.20.10
gnome:gnome_display_managergnome gnome display managereq2.20.6
gnome:gnome_display_managergnome gnome display managereq2.20.0
gnome:gnome_display_managergnome gnome display managereq2.20.5
gnome:gnome_display_managergnome gnome display managereq2.20.1
gnome:gnome_display_managergnome gnome display managereq2.20.3
gnome:gnome_display_managergnome gnome display managereq2.20.2
gnome:gnome_display_managergnome gnome display managereq2.20.9
gnome:gnome_display_managergnome gnome display managereq2.20.7

CPE	Name	Operator	Version
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.8
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.10
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.6
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.0
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.5
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.1
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.3
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.2
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.9
gnome:gnome_display_manager	gnome gnome display manager	eq	2.20.7

Rows per page:

1-10 of 111

References

ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes

secunia.com/advisories/40690

secunia.com/advisories/40780

www.auscert.org.au/13123

www.osvdb.org/66643

blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure

bugzilla.gnome.org/show_bug.cgi?id=571846

exchange.xforce.ibmcloud.com/vulnerabilities/60642

6.7 Medium

AI Score

Confidence

Low

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

Related for CVE-2010-2387

prion1 cvelist1 ubuntucve1