Synopsis: Moderate: gdm security update
Issue Date: 2011-03-28
CVE Numbers: CVE-2011-0727
—
The GNOME Display Manager (GDM) provides the graphical login screen, shown
shortly after boot up, log out, and when user-switching.
A race condition flaw was found in the way GDM handled the cache
directories used to store users’ dmrc and face icon files. A local attacker
could use this flaw to trick GDM into changing the ownership of an
arbitrary file via a symbolic link attack, allowing them to escalate their
privileges. (CVE-2011-0727)
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for
reporting this issue.
All users should upgrade to these updated packages, which contain a
backported patch to correct this issue. GDM must be restarted for this
update to take effect. Rebooting achieves this, but changing the runlevel
from 5 to 3 and back to 5 also restarts GDM.
—
SL6
x86_64
gdm-2.30.4-21.el6_0.1.x86_64.rpm
gdm-libs-2.30.4-21.el6_0.1.i686.rpm
gdm-libs-2.30.4-21.el6_0.1.x86_64.rpm
gdm-plugin-fingerprint-2.30.4-21.el6_0.1.x86_64.rpm
gdm-plugin-smartcard-2.30.4-21.el6_0.1.x86_64.rpm
gdm-user-switch-applet-2.30.4-21.el6_0.1.x86_64.rpm
i386
gdm-2.30.4-21.el6_0.1.i686.rpm
gdm-libs-2.30.4-21.el6_0.1.i686.rpm
gdm-plugin-fingerprint-2.30.4-21.el6_0.1.i686.rpm
gdm-plugin-smartcard-2.30.4-21.el6_0.1.i686.rpm
gdm-user-switch-applet-2.30.4-21.el6_0.1.i686.rpm
– Scientific Linux Development Team
