Synopsis

Important: xscreensaver security update

Type/Severity

Security Advisory: Moderate

Topic

An updated xscreensaver package that fixes a security flaw is now
available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

XScreenSaver is a collection of screensavers.

Alex Yamauchi discovered a flaw in the way XScreenSaver verifies user
passwords. When a system is using a remote directory service for login
credentials, a local attacker may be able to cause a network outage causing
XScreenSaver to crash, unlocking the screen. (CVE-2007-1859)

Users of XScreenSaver should upgrade to this updated package, which
contains a backported patch to correct this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc

Fixes

• BZ - 237003 - CVE-2007-1859 xscreensaver authentication bypass

CVEs

• CVE-2007-1859

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
x86_64
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
ia64
xscreensaver-4.18-5.rhel4.14.ia64.rpm	SHA-256: 36d74e537ea7c8c62a80f7defde4c20eb8c892a6313a7798616c77625fe64753
xscreensaver-4.18-5.rhel4.14.ia64.rpm	SHA-256: 36d74e537ea7c8c62a80f7defde4c20eb8c892a6313a7798616c77625fe64753
i386
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2

Red Hat Enterprise Linux Server - Extended Update Support 4.5

SRPM
x86_64
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
ia64
xscreensaver-4.18-5.rhel4.14.ia64.rpm	SHA-256: 36d74e537ea7c8c62a80f7defde4c20eb8c892a6313a7798616c77625fe64753
xscreensaver-4.18-5.rhel4.14.ia64.rpm	SHA-256: 36d74e537ea7c8c62a80f7defde4c20eb8c892a6313a7798616c77625fe64753
i386
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
ia64
xscreensaver-4.18-5.rhel4.14.ia64.rpm	SHA-256: 36d74e537ea7c8c62a80f7defde4c20eb8c892a6313a7798616c77625fe64753
i386
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
xscreensaver-4.18-5.rhel4.14.x86_64.rpm	SHA-256: feabada01b2f91cda1066f2e26decbc711071af49b1a7c11016793a30d7f99cb
i386
xscreensaver-4.18-5.rhel4.14.i386.rpm	SHA-256: de38dba2f961d56cf77d2334dc21597ec0723ebca5a00f7a9bbd350a48a89bc2

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
xscreensaver-4.18-5.rhel4.14.s390x.rpm	SHA-256: 32d305af1692b5c3c6b9f6d21a191a920b731e55de20846acf4dccd78a02037d
s390
xscreensaver-4.18-5.rhel4.14.s390.rpm	SHA-256: c592ce5006454ddbf6dd2804138c73c8875af8f3bf241ba31ba3f703c2685886

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5

SRPM
s390x
xscreensaver-4.18-5.rhel4.14.s390x.rpm	SHA-256: 32d305af1692b5c3c6b9f6d21a191a920b731e55de20846acf4dccd78a02037d
s390
xscreensaver-4.18-5.rhel4.14.s390.rpm	SHA-256: c592ce5006454ddbf6dd2804138c73c8875af8f3bf241ba31ba3f703c2685886

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
xscreensaver-4.18-5.rhel4.14.ppc.rpm	SHA-256: 81a3d3fa72363cc16e2521354a6acc8a66f2c6decc7c6170cdf63d24700d135f

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
ppc
xscreensaver-4.18-5.rhel4.14.ppc.rpm	SHA-256: 81a3d3fa72363cc16e2521354a6acc8a66f2c6decc7c6170cdf63d24700d135f