GNOME Display Manager '/var/log/messages' Information Disclosure Vulnerability

Bugtraq ID:	42016
Class:	Design Error
CVE:	CVE-2010-2387
Remote:	No
Local:	Yes
Published:	Jun 02 2010 12:00AM
Updated:	Jun 02 2010 12:00AM
Credit:	Antoine Jacoutot
Vulnerable:	GNOME GDM 2.20.10 GNOME GDM 2.19.5 GNOME GDM 2.19.4 GNOME GDM 2.19.3 GNOME GDM 2.19.2 GNOME GDM 2.19.1 GNOME GDM 2.18.4 GNOME GDM 2.18.3 GNOME GDM 2.18.2 GNOME GDM 2.18.1 GNOME GDM 2.17.4 GNOME GDM 2.16.7 GNOME GDM 2.16.6 GNOME GDM 2.16.5 GNOME GDM 2.16.4 GNOME GDM 2.16.3 GNOME GDM 2.16.2 GNOME GDM 2.16.1 GNOME GDM 2.16 GNOME GDM 2.14.13 GNOME GDM 2.14.12 GNOME GDM 2.14.11 GNOME GDM 2.14.1 GNOME GDM 2.12
Not Vulnerable:	GNOME GDM 2.20.11

GNOME Display Manager '/var/log/messages' Information Disclosure Vulnerability

GNOME Display Manager is prone to an information-disclosure vulnerability.

An attacker may exploit this issue to disclose user passwords.

GNOME Display Manager versions prior to 2.20.11 are affected.

GNOME Display Manager '/var/log/messages' Information Disclosure Vulnerability

An attacker can exploit this issue using standard commands.

GNOME Display Manager '/var/log/messages' Information Disclosure Vulnerability

Solution:
The vendor has released an update to address this issue. Please see references for more information.

GNOME Display Manager '/var/log/messages' Information Disclosure Vulnerability

References:

• Bug 571846 - user password may end up in /var/log/messages (GNOME)
  
• GNOME Display Manager 2.20.11 Changelog (GNOME)
  
• GNOME Display Manager Homepage (GNOME)
  
• CVE-2010-2387 Password disclosure vulnerability in GNOME Display Manager (gdm) (Sun Microsystems)