« Volver al listado

CVE-2013-4143

Estado: ModificadaBaja (2.1)—

The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

David Bagley — Xlockmore

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4143",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-05-30T14:55:08.257",
  "references": [
    {
      "url": "http://openwall.com/lists/oss-security/2013/07/16/8",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2013/07/18/6",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.tux.org/~bagleyd/xlock/xlockmore.README",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2013/07/16/8",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2013/07/18/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.tux.org/~bagleyd/xlock/xlockmore.README",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts."
    },
    {
      "lang": "es",
      "value": "Las funciones (1) checkPasswd y (2) checkGroupXlockPasswds en xlockmore anterior a 5.43 no se manejan debidamente cuando un valor nulo está devuelto en un error por la función crypt o dispcrypt tal y como está implementado en glibc 2.17 y posteriores, lo que permite a atacantes evadir el bloqueo de pantalla a través de vectores relacionados con salts inválidos."
    }
  ],
  "lastModified": "2026-06-16T23:56:42.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E616802-AE2E-4659-85A2-C0F52B69F333",
              "versionEndIncluding": "5.42"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "688E5398-EEEE-496F-9540-A666410A8E8B"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE0242C8-5BD8-4F1E-9E35-6672DEC7C66C"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A071A240-6024-4D7A-8172-AF53550D451B"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54AF7E13-5892-47F3-BE14-8F2F7982F31C"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9EF8C2D-30A2-4602-9BEE-D9502CC3A3B1"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.29:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22534189-F40E-4073-9028-CAB6ACBC39D3"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84701664-C659-4347-9F13-F0CDCE08CA71"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF3D0BE2-DBB6-40BA-92AF-AE4E2EFFCA1F"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3698DA33-BB9E-4473-8CD2-950314668615"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB90F6FE-C8A0-4B07-A6FB-53584EB7B426"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4A6AEFC-42A5-468A-960D-DD53624A1687"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.35:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55C5B941-D793-4DFA-8F80-18BDA427445E"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.36:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5DEDA8B-6575-44D8-97D5-043E21F49982"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.37:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FED4EE4B-266D-40A2-99C3-51A4EB72A5D8"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.38:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EB050A6-C0BB-416C-9972-69CF4056DC85"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.39:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "244178C6-AB99-4E9C-ADD3-BDE537FDE551"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C40F0F8-86BC-4DB6-A0B5-63DED3744178"
            },
            {
              "criteria": "cpe:2.3:a:david_bagley:xlockmore:5.41:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3EBDA64-B0BA-45F9-8483-4936121864AC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "per http://cwe.mitre.org/data/definitions/476.html\n\n\"CWE-476: NULL Pointer Dereference\"",
  "sourceIdentifier": "secalert@redhat.com"
}