"Start new session" auto logs in as previous new session starter (only in Edgy)

[monstermunch]

Binary package hint: kdm

I'm running kubuntu 6.10.

Instructions:
Use KDM as your login manager and login to KDE.
Open a terminal.
Type "sudo adduser bug" and fill in the details to create a new user called "bug".
Goto K-menu->Switch User->Start New Session.
The KDM login manager screen should appear. Login as "bug" with your password.
Logout as bug and switch back to your first session (should happen automatically).
Goto K-menu->Switch User->Start New Session.

What happens:
You will be automatically logged into KDE as "bug" without being asked if you wanted to or being asked for the password.

What I expected:
To be presented with the KDM login screen.

If you wait a couple of minutes before doing the final instruction, the expected behaviour happens. My KDM settings say to automatically log in on X server crash and auto-login my main (not "bug") user.

This seems like a serious security problem to me in an environment where people share machines as it would be easy to let someone login as your new session, wait for them to log out and then login to their account with no password.

[Marco Maini (maini10)]

I have made today your test. In Feisty the Kdm login screen suggest "bug" as username but password is required. So in my opinion there are none security problem. I don't know the behaviour in Edgy.
Thanks for your report.

[monstermunch (monstermunch)]

I've just installed Feisty and can confirm that the expected (i.e. it doesn't login automatically) happens. However, I still have this behaviour in Edgy.

I really urge someone to look at this because if this happens on other computers and not just mine this is a very serious bug. By using a simple trick, you can log into anyone's account after they've just logged in and out of a new session recently.

[Marco Maini (maini10)]

Confirm this bug, because needs to be tested in Edgy. If confirmed it may be a security problem. However, in Feisty seems fixed.

[monstermunch (monstermunch)]

I've just installed Kubuntu Gutsy and can confirm that this behaviour (as described in the original bug report) is now back. It was present in Edgy, fixed in Feisty and it's back in Gutsy.

[monstermunch (monstermunch)]

This behaviour still happens in Hardy. :-(

[Sergio Zanchetta (primes2h)]

The 18 month support period for Edgy Eft 6.10 has reached it's end of life. As a result, we are closing the Edgy Eft task. However, please note that this report will remain open against the actively developed release. Thank you for your continued support and help as we debug this issue.

[Jonathan Thomas (echidnaman)]

Still an issue in Intrepid?

[Jonathan Thomas (echidnaman)]

Actually, should be closed as per the comment before mine.