Vulnerability Description
Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.
CVSS Score
3.7
LOW
AV:L/AC:H/Au:N/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Gdm | 2.14 |
Related Weaknesses (CWE)
References
- http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261
- http://www.debian.org/security/2006/dsa-1040PatchVendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:083
- http://www.redhat.com/support/errata/RHSA-2007-0286.html
- http://www.securityfocus.com/bid/17635
- http://www.vupen.com/english/advisories/2006/1465Vendor Advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188303
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26092
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- https://usn.ubuntu.com/278-1/
- https://www.redhat.com/archives/fedora-announce-list/2006-April/msg00160.htmlPatch
- http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261
- http://www.debian.org/security/2006/dsa-1040PatchVendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:083
- http://www.redhat.com/support/errata/RHSA-2007-0286.html
FAQ
What is CVE-2006-1057?
CVE-2006-1057 is a vulnerability with a CVSS score of 3.7 (LOW). Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.
How severe is CVE-2006-1057?
CVE-2006-1057 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-1057?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Gdm.