Description
backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | kdebase | 4:3.5.7-3lenny1 | DTSA-60-1 |
| Debian 4.0 | kdebase | 4:3.5.5a.dfsg.1-6etch1 | DSA-1376-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdebase +1 | 6:3.5.4-15.el5 | RHSA-2007:0905 |
| RHEL 4 | kdebase +1 | 6:3.3.1-6.el4 | RHSA-2007:0905 |
Advisories 3
- RHSA-2007:0905 Red Hat Security Advisory: kdebase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-60-1 kdebase - kdm allows user logins without a password in some configurations Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1376-1 kdebase - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 27271 third-party-advisory
- GLSA-200710-15 vendor-advisory
- 26904 third-party-advisory
- 26894 third-party-advisory
- FEDORA-2007-2361 vendor-advisory
- DSA-1376 vendor-advisory
- FEDORA-2007-716 vendor-advisory
- RHSA-2007:0905 vendor-advisory
- 27180 third-party-advisory
- 26915 third-party-advisory
- http://www.kde.org/info/security/advisory-20070919-1.txt
- ADV-2007-3227 vdb-entry
- 26977 third-party-advisory
- 27106 third-party-advisory
- oval:org.mitre.oval:def:10359 vdb-entry signature
- 26929 third-party-advisory
- SUSE-SR:2007:021 vendor-advisory
- 27089 third-party-advisory
- 27096 third-party-advisory
- MDKSA-2007:190 vendor-advisory
- 1018724 vdb-entry
- kde-kdm-login-security-bypass(36711) vdb-entry
- USN-517-1 vendor-advisory
- 25730 vdb-entry
- https://issues.rpath.com/browse/RPL-1725