kdm vulnerability

2007-09-2500:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

AI Score

6.3

Confidence

Low

EPSS

0.004

Percentile

74.3%

JSON

Releases

Ubuntu 7.04
Ubuntu 6.10
Ubuntu 6.06

Packages

kdebase -

Details

It was discovered that KDM would allow logins without password checks
under certain circumstances. If autologin was configured, and “shutdown
with password” enabled, a local user could exploit the problem and gain
root privileges.

OSVersionArchitecturePackageVersionFilename
Ubuntu7.04noarchkdm< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkappfinder< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkate< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkcontrol< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdebase-bin< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdebase-dbg< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdebase-dev< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdebase-kio-plugins< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdepasswd< 4:3.5.6-0ubuntu20.4UNKNOWN
Ubuntu7.04noarchkdeprint< 4:3.5.6-0ubuntu20.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	7.04	noarch	kdm	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kappfinder	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kate	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kcontrol	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdebase-bin	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdebase-dbg	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdebase-dev	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdebase-kio-plugins	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdepasswd	< 4:3.5.6-0ubuntu20.4	UNKNOWN
Ubuntu	7.04	noarch	kdeprint	< 4:3.5.6-0ubuntu20.4	UNKNOWN