Vulnerability CVE-2007-4569


Published: 2007-09-21   Modified: 2012-02-12

Description:
backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors.

CVSS2 => (AV:L/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
10/10
3.1/10
Exploit range
Attack complexity
Authentication
Local
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
KDE -> KDE 

 References:
http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
http://security.gentoo.org/glsa/glsa-200710-15.xml
http://securitytracker.com/id?1018724
http://www.debian.org/security/2007/dsa-1376
http://www.kde.org/info/security/advisory-20070919-1.txt
http://www.mandriva.com/security/advisories?name=MDKSA-2007:190
http://www.redhat.com/support/errata/RHSA-2007-0905.html
http://www.securityfocus.com/bid/25730
http://www.ubuntu.com/usn/usn-517-1
http://www.vupen.com/english/advisories/2007/3227
https://exchange.xforce.ibmcloud.com/vulnerabilities/36711
https://issues.rpath.com/browse/RPL-1725
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10359
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00022.html
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00084.html

Copyright 2024, cxsecurity.com

 

Back to Top