Description
GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users to access the "Configure Login Manager" functionality using their own password instead of the root password, which can be leveraged to gain additional privileges.
References
- 20532 third-party-advisory
- SUSE-SR:2006:013 vendor-advisory
- 20627 third-party-advisory
- ADV-2006-2239 vdb-entry
- USN-293-1 vendor-advisory
- 20060608 rPSA-2006-0098-1 gdm mailing-list
- http://bugzilla.gnome.org/show_bug.cgi?id=343476
- GLSA-200606-14 vendor-advisory
- 18332 vdb-entry
- 20636 third-party-advisory
- gdm-facebrowser-security-bypass(27018) vdb-entry
- 20587 third-party-advisory
- 20552 third-party-advisory
- MDKSA-2006:100 vendor-advisory