lock screen bypass

[Frederic BARDY]

I found a bug allowing a user to bypass the new lock screen of Ubuntu 14.04

1 - When the screen is locked just right click multiple times on the indicator bar (for example on the battery indicator), then shortcuts are available.
2 - Press ALT+F2
3 - you can execute the command you whant on behalf of the logged user.

Here is a video demonstrating this bug : http://www.youtube.com/watch?v=d4UUB0sI5Fc

lsb_release -rd
Description: Ubuntu 14.04 LTS
Release: 14.04

Ubuntu version updated the 04/28/2014

apt-cache policy unity
unity:
  Installed: 7.2.0+14.04.20140416-0ubuntu1
  Candidate: 7.2.0+14.04.20140416-0ubuntu1
  Version table:
 *** 7.2.0+14.04.20140416-0ubuntu1 0
        500 http://fr.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
        100 /var/lib/dpkg/status

[Brandon Schaefer (brandontschaefer)]

I can get the dash to pop up (which is an issue), but I cant input anything into the dash. It goes to the input for the lockscreen.

Either way, the command lens shouldn't be popping up.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.2.0+14.04.20140423-0ubuntu1.1

---------------
unity (7.2.0+14.04.20140423-0ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: lock screen bypass (LP: #1313885)
    - debian/patches/lp1313885.patch: improve lockscreen logic in
      lockscreen/LockScreenController.cpp, lockscreen/LockScreenShield.*,
      plugins/unityshell/src/unityshell.*.
 -- Marc Deslauriers <email address hidden> Mon, 28 Apr 2014 22:29:13 -0400

[Marc Deslauriers (mdeslaur)]

http://www.ubuntu.com/usn/usn-2184-1/

[azul (azul)]

I can still bypass the logscreen by rightclicking the indicators.

In order to reproduce:

Open a Terminal
Press CTRL+ALT+L to lock the screen
right click the indicators some times
type and you will enter into the terminal not the password field

The easiest way to reproduce this is to play some music with mplayer in the terminal. If you can stop the music, skip a song etc. with your keys press CTRL+c to quit mplayer. Now you can type whatever you want and it will be executed.

This probably affects other Programs. I can even switch the terminal with the default shortcuts. I guess i could also start one with CTRL+ALT+T but i need to confirm that.

I just installed the fix above. Have not rebooted though. So that might fix it.

[azul (azul)]

Confirmed that CTRL+ALT+T for a new terminal works.

[azul (azul)]

reboot did not fix it.

[Marc Deslauriers (mdeslaur)]

@azul: please file a new bug, that is likely a different issue.

[Mateusz Stachowski (stachowski-mateusz)]

@azul and @Marc I reported a new bug for the problem discovered by azul.

https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1314294

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.2.0+14.04.20140423-0ubuntu1.1

---------------
unity (7.2.0+14.04.20140423-0ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: lock screen bypass (LP: #1313885)
    - debian/patches/lp1313885.patch: improve lockscreen logic in
      lockscreen/LockScreenController.cpp, lockscreen/LockScreenShield.*,
      plugins/unityshell/src/unityshell.*.
 -- Marc Deslauriers <email address hidden> Mon, 28 Apr 2014 22:29:13 -0400