Vulnerability Name:

CVE-2005-0078 (CCN-19084)

Assigned:2005-01-26
Published:2005-01-26
Updated:2017-10-11
Summary:The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2005-0078

Source: CCN
Type: RHSA-2005-009
kdelibs

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-660

Source: DEBIAN
Type: DSA-660
kdebase -- missing return value check

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2005:009

Source: CCN
Type: BID-12373
KDE Screensaver Lock Bypass Vulnerability

Source: XF
Type: UNKNOWN
kdebase-screensaver-security-bypass(19084)

Source: XF
Type: UNKNOWN
kdebase-screensaver-security-bypass(19084)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9260

Vulnerable Configuration:Configuration 1:
  • cpe:/o:debian:debian_linux:3.0:*:woody:*:*:*:*:*
  • OR cpe:/o:kde:kde:1.0:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:1.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.1_beta1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.1_beta2:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:2.2_beta1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0_beta_1:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.0_beta_2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:advanced_servers:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:9260
    V
    		Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
    2013-04-29
    oval:com.redhat.rhsa:def:20050009
    P
    		RHSA-2005:009: kdelibs, kdebase security update (Important)
    2005-02-10
    oval:org.debian:def:660
    V
    		missing return value check
    2005-01-26
    BACK
    debian debian linux 3.0
    kde kde 1.0
    kde kde 1.1
    kde kde 1.1.1
    kde kde 1.1.2
    kde kde 2.0
    kde kde 2.0.1
    kde kde 2.1
    kde kde 2.1_beta1
    kde kde 2.1_beta2
    kde kde 2.2
    kde kde 2.2.1
    kde kde 2.2_beta1
    kde kde 3.0
    kde kde 3.0.1
    kde kde 3.0.2
    kde kde 3.0.3
    kde kde 3.0.4
    kde kde 3.0_beta_1
    kde kde 3.0_beta_2
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux desktop 3.0
    redhat linux advanced workstation 2.1