oss-security - Re: Ubuntu 14.04: security problem in the lock screen

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <535F9A59.3060107@canonical.com>
Date: Tue, 29 Apr 2014 08:26:01 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: Ubuntu 14.04: security problem in the lock screen

Hi,

On 14-04-26 11:06 AM, Kurt Seifried wrote:
> https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572
> 
> Probably needs a CVE.
> 

While that particular bug was fixed before 14.04 was released, it's probably
worth assigning a CVE to it anyway for tracking purposes, since I have now
published a security update that corrects two more lock screen bugs.

Here's a summary:

Issue #1 (Before 14.04 came out):

Marco Agnese discovered that Unity 7.2.0 incorrectly handled entry activation on
the lock screen, resulting in the lock screen crashing and the session becoming
unlocked.

Reference:
https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572
http://bazaar.launchpad.net/~unity-team/unity/trunk/revision/3787

Issue #2:

Giovanni Mellini discovered that Unity 7.2.0 could display the Dash in certain
conditions when the screen was locked. A local attacker could possibly use
this issue to run commands, and unlock the current session.

Reference:
https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308850
http://bazaar.launchpad.net/~unity-team/unity/trunk/revision/3789
http://www.ubuntu.com/usn/usn-2184-1/

Issue #3:

Frédéric Bardy discovered that Unity 7.2.0 incorrectly filtered keyboard
shortcuts when the screen was locked. A local attacker could possibly use
this issue to run commands, and unlock the current session.

Reference:
https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1313885
https://code.launchpad.net/~3v1n0/unity/lockscreen-keys-disable/+merge/217528
http://www.ubuntu.com/usn/usn-2184-1/

Could CVEs please be assigned to these three issues?

Thanks!

Marc.

-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.