Your message dated Tue, 24 Jul 2007 20:20:50 -0400
with message-id <[EMAIL PROTECTED]>
and subject line possible security problem with xscreensaver
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: xscreensaver
Version: 4.24-5
Severity: grave
Tags: security
Justification: user security hole
Hi mate
Please have a look at the patch below I found in the Ubuntu version of
your package. Your package was showing up on the security tracker and I
found a CVE assigned for it. It seems that the patch below fixed the issue
for ubuntu, though I did no further investigation. Maybe you can have
a look and if this information is wrong, feel free to downgrade the bug.
Cheers
Steffen
diff -u xscreensaver-4.24/debian/changelog xscreensaver-4.24/debian/changelog
--- xscreensaver-4.24/debian/changelog
+++ xscreensaver-4.24/debian/changelog
@@ -1,3 +1,12 @@
+xscreensaver (4.24-5ubuntu2.1) feisty-security; urgency=low
+
+ * SECURITY UPDATE: password bypass when using network authentication.
+ * driver/lock.c: upstream fixes applied inline.
+ * References
+ CVE-2007-1859
+
+ -- Kees Cook <[EMAIL PROTECTED]> Mon, 11 Jun 2007 12:58:25 -0700
+
xscreensaver (4.24-5ubuntu2) feisty; urgency=low
* debian/control:
diff -u xscreensaver-4.24/driver/lock.c xscreensaver-4.24/driver/lock.c
--- xscreensaver-4.24/driver/lock.c
+++ xscreensaver-4.24/driver/lock.c
@@ -1532,7 +1532,7 @@
*/
struct passwd *pw = getpwuid (getuid ());
char *d = DisplayString (si->dpy);
- char *u = (pw->pw_name ? pw->pw_name : "???");
+ char *u = (pw && pw->pw_name ? pw->pw_name : "???");
int opt = 0;
int fac = 0;
--- End Message ---
--- Begin Message ---
Version: 5.03-1
This is fixed in the last uploaded version.
Regards,
Jose Luis.
--
ghostbar on Linux/Debian 'sid' x86_64-SMP - #382503
Weblog: http://ghostbar.ath.cx/ - http://linuxtachira.org
http://debian.org.ve - irc.debian.org #debian-ve #debian-devel-es
San Cristóbal, Venezuela. http://chaslug.org.ve
Fingerprint = 3E7D 4267 AFD5 2407 2A37 20AC 38A0 AD5B CACA B118
signature.asc
Description: OpenPGP digital signature
--- End Message ---
