----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
gnome-screensaver Information Disclosure and Security Bypass

SECUNIA ADVISORY ID:
SA29595

VERIFY ADVISORY:
https://secunia.com/advisories/29595/

CRITICAL:
Not critical

IMPACT:
Security Bypass, Exposure of sensitive information

WHERE:
Local system

SOFTWARE:
gnome-screensaver 2.x
https://secunia.com/product/18169/
GNOME 2.x
https://secunia.com/product/3277/

DESCRIPTION:
A weakness and a security issue have been reported in
gnome-screensaver, which can be exploited by malicious people with
physical access to disclose potentially sensitive information or
bypass certain security restrictions.

1) A weakness is caused due to the "Leave message" feature allowing
attackers to e.g. paste the contents of the clipboard of the user
who's screen is currently locked, which can be exploited to disclose
potentially sensitive information.

2) A security issue is caused due to an error if the NIS
authentication method is used. This can be exploited to bypass the
authentication check and unlock the screen if the NIS server is not
reachable.

SOLUTION:
Update to version 2.22.1 or later. Vulnerability #1 is fixed in
version 2.21.6 or later.

PROVIDED AND/OR DISCOVERED BY:
1) Josh Smith
2) Alan Matsuoka

ORIGINAL ADVISORY:
1)
https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/146862
2) https://bugzilla.redhat.com/show_bug.cgi?id=435773

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
https://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
https://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------