LightDM GTK Greeter

greeter crashes on empty username

Bug #1266449 reported by Guido Berhoerster on 2014-01-06

256

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	LightDM GTK Greeter	Fix Released	Undecided	Unassigned	LightDM GTK Greeter 1.7.1
	lightdm-gtk-greeter (Debian)	New	Undecided	Unassigned

Bug Description

lightdm-gtk-greeter uses the lightdm-gobject API incorrectly and does not handle the possibility of lightdm_greeter_get_authentication_user() returning NULL when the username of the previous authentication is invalid, i.e. when it was empty, resulting in a NULL pointer dereference in start_authentication().

Revision history for this message

Guido Berhoerster (gber) wrote on 2014-01-07:

This is a security issue due to the possibility of a local denial of service. A CVE has been requested at
http://thread.gmane.org/gmane.comp.security.oss.general/11812

information type:

Public → Public Security

Revision history for this message

Yves-Alexis Perez (corsac) wrote on 2014-01-07:

fix crash with NULL username Edit (596 bytes, text/plain)

I can confirm on Debian sid with 1.6. Here's a patch against our package, taken from the Suse report. There are other strcmp() which might need checking too.

Revision history for this message

Sean Davis (bluesabre) wrote on 2014-01-08:

Thanks everyone, fixed in trunk.