CVE-2010-2387

vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes
http://secunia.com/advisories/40690	Vendor Advisory
http://secunia.com/advisories/40780	Vendor Advisory
http://www.auscert.org.au/13123	US Government Resource
http://www.osvdb.org/66643
https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure
https://bugzilla.gnome.org/show_bug.cgi?id=571846
https://exchange.xforce.ibmcloud.com/vulnerabilities/60642

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gnome:gnome_display_manager:2.20.0:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.1:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.2:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.3:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.4:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.5:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.6:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.7:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.8:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.9:::::::*
	cpe:2.3:a:gnome:gnome_display_manager:2.20.10:::::::*

History

No history.

Information

Published : 2012-12-21 05:46

Updated : 2017-08-17 01:32

NVD link : CVE-2010-2387

Mitre link : CVE-2010-2387

CVE.ORG link : CVE-2010-2387

JSON object : View

Products Affected

gnome

gnome_display_manager

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2010-2387", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-12-21T05:46:13.853", "references": [{"url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes", "source": "secalert_us@oracle.com"}, {"url": "http://secunia.com/advisories/40690", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://secunia.com/advisories/40780", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.auscert.org.au/13123", "tags": ["US Government Resource"], "source": "secalert_us@oracle.com"}, {"url": "http://www.osvdb.org/66643", "source": "secalert_us@oracle.com"}, {"url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure", "source": "secalert_us@oracle.com"}, {"url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846", "source": "secalert_us@oracle.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642", "source": "secalert_us@oracle.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs."}, {"lang": "es", "value": "vicious-extensions/ve-misc.c en GNOME Display Manager (GDM) v2.20.x antes de v2.20.11, cuando la depuraci\u00f3n GDM est\u00e1 habilitada, registra la contrase\u00f1a de usuario cuando contiene caracteres no v\u00e1lidos UTF8 codificados, lo que podr\u00eda permitir a usuarios locales obtener privilegios mediante la lectura de la informaci\u00f3n de los registros de syslog."}], "lastModified": "2017-08-17T01:32:43.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8C72BE3-BDD4-4A88-8E2A-7C8224B02F76"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "706CCECA-D2FC-40E6-B587-B6E3DD62075D"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DA2D465-D13D-4871-A15F-BD54C602867D"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0C53894-4DA5-425F-9DEB-C0371B206FBC"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06EB6BB7-9C4E-4D6B-8ED1-3588E290ADEC"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "409CA831-8DD2-4ED0-9E46-E6EACA01D818"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D80F8AA1-0DBA-4B4A-8003-0977632EB92D"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67E978B3-1614-4591-B58E-9BA781AE0BE3"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5535C17-2D38-49EC-8D44-F99F0B2BEB5E"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE4EA4E1-3B52-4DD1-930D-8E88A2494D22"}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "943E0B71-8FC7-46FB-BA5D-E3A2FD78636F"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}