BID:8846

Multiple GDM Local Denial Of Service Vulnerabilities

Info

Multiple GDM Local Denial Of Service Vulnerabilities

Bugtraq ID:	8846
Class:	Unknown
CVE:	CVE-2003-0793 CVE-2003-0794
Remote:	No
Local:	Yes
Published:	Oct 17 2003 12:00AM
Updated:	Jul 11 2009 11:56PM
Credit:	These vulnerabilities were announced in a Mandrake advisory.
Vulnerable:	Martin K. Peterson gdm 2.4.4 .2 Martin K. Peterson gdm 2.4.4 + Mandriva Linux Mandrake 9.2 Martin K. Peterson gdm 2.4.1 0 Martin K. Peterson gdm 2.4.1 .6 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Mandriva Linux Mandrake 9.0 Martin K. Peterson gdm 2.4.1 .5 Martin K. Peterson gdm 2.4.1 .4 Martin K. Peterson gdm 2.4.1 .3 + SOTLinux SOTLinux 2003 Desktop + SOTLinux SOTLinux 2003 Server Martin K. Peterson gdm 2.4.1 .2 Martin K. Peterson gdm 2.4.1 .1 Martin K. Peterson gdm 2.4 .0.11 + Conectiva Linux Enterprise Edition 1.0 Martin K. Peterson gdm 2.2.5 .4

Not Vulnerable:	Martin K. Peterson gdm 2.4.4 .4

Discussion

Multiple GDM Local Denial Of Service Vulnerabilities

GDM has been reported prone to multiple denial of service vulnerabilities that may be triggered by a local attacker.

It has been reported that GDM does not perform sufficient restrictions on data that it receives. A local attacker may exploit this issue to cause the kernel to kill the GDM process.

Additionally a separate issue has been reported to affect GDM. The issue has been reported to present itself due to an error while handling queries. It has been reported that an attacker may invoke a query request against GDM in a sufficient manner and trigger GDM into filling its send buffer. This will have the affect of preventing GDM from accepting new logins.

Exploit / POC

Multiple GDM Local Denial Of Service Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple GDM Local Denial Of Service Vulnerabilities

Solution:
Conectiva has released an advisory (CLA-2003:766) and fixes to address this issue. Affected users are advised to apply relevant fixes as soon as possible.

Mandrake Linux has released an advisory (MDKSA-2003:100) and fixes to address this issue. Affected users are advised to apply relevant fixes as soon as possible.

Slackware Linux has released advisory SSA:2003-300-01 to address this issue.

Conectiva has also released an advisory (CLSA-2003:792) including a fix to address this issue in CLEE 1.0.

The vendor has addressed this issue in gdm 2.4.4.4.

Martin K. Peterson gdm 2.4 .0.11