News
Vigil@nce - GNOME Display Manager: execution of a web browser
June 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An unauthenticated attacker can start a web browser with
privileges of the "gdm" user.
Severity: 2/4
Creation date: 06/06/2011
IMPACTED PRODUCTS
– Fedora
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The GNOME Display Manager offers a login window.
When the user enters an uri (http, file, ftp, etc.) in a GNOME
field, a handler (external program) associated to the MIME type of
the uri is called. However, since glib version 2.28, this feature
is also enabled in the login window.
An unauthenticated attacker can therefore start a web browser with
privileges of the "gdm" user.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/GNOME-Display-Manager-execution-of-a-web-browser-10703
