USN-898-1: gnome-screensaver vulnerability

Posted by Bob on: 02/10/2010 04:40 PM [ Print | 0 comment(s) ]

A new gnome-screensaver vulnerability update is available for Ubuntu Linux. Here the announcement:

Ubuntu Security Notice USN-898-1 February 10, 2010
gnome-screensaver vulnerability
CVE-2010-0414
==========================
==========================
=========

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
gnome-screensaver 2.28.0-0ubuntu3.4

After a standard system upgrade you need to restart your session to effect
the necessary changes.

Details follow:

It was discovered that gnome-screensaver did not correctly handle monitor
hotplugging. An attacker with physical access could cause gnome-screensaver
to crash and gain access to the locked session.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-s=
creensaver_2.28.0-0ubuntu3.4.diff.gz
Size/MD5: 14438 df2eeb9fde262814316d3d909bcc29aa
http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-s=
creensaver_2.28.0-0ubuntu3.4.dsc
Size/MD5: 1757 6aa4026ae6faa87f58a76d0def8220cb
http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-s=
creensaver_2.28.0.orig.tar.gz
Size/MD5: 5069053 cdf328a0443a3cc30b4b2b36d9a99236

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-s=
creensaver_2.28.0-0ubuntu3.4_amd64.deb
Size/MD5: 4185932 a64b30c3d21a6914d1a2376c9b85c34d

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-s=
creensaver_2.28.0-0ubuntu3.4_i386.deb
Size/MD5: 4169482 988fb3a93243e21d863462a7ec9c4d71

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver=
_2.28.0-0ubuntu3.4_lpia.deb
Size/MD5: 4170332 40dcb1fb1c203811b2c4c0895a9e22af

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver=
_2.28.0-0ubuntu3.4_powerpc.deb
Size/MD5: 4179928 709de0a74df0c05f3605b30eae34edba

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver=
_2.28.0-0ubuntu3.4_sparc.deb
Size/MD5: 4178372 cc91e447b311c1f509cbcfbf635c92a6

--=-UVW1wAISkaADGphJLKuu
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEABECAAYFAkty0tQACgkQLMAs/0C4zNpsiwCfdesxv8k2YpxqX82Ggu1FVWTB
suIAnAqGGeStxQnvwwGY3uTk+8EKKUNo
=xKzG
-----END PGP SIGNATURE-----