Freely subscribe to our NEWSLETTER

Severity: 1/4

Consequences: data reading

Provenance: user console

Means of attack: no proof of concept, no attack

Ability of attacker: expert (4/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: high (3/3)

Creation date: 26/10/2009

IMPACTED PRODUCTS

– Sun Solaris

DESCRIPTION OF THE VULNERABILITY

The XScreenSaver program is used to lock the screen, and hides the
content of user’s session.

Accessibility features (gnome-accessibility-keyboard-properties)
ease the access to people with disabilities.

When accessibility features are enabled, popup windows are
displayed through XScreenSaver.

A local attacker can thus obtain sensitive information displayed
in these popups.

This vulnerability is different from VIGILANCE-VUL-8920
(https://vigilance.fr/tree/1/8920). It is only present with
patches 120094-27 and 28.

CHARACTERISTICS

Identifiers: 268288, 6875930, CVE-2009-3746, VIGILANCE-VUL-9123

http://vigilance.fr/vulnerability/Solaris-insufficient-locking-of-XScreenSaver-9123