Note: This is an archival copy of Security Sun Alert 249646 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019951.1.
Solaris 10 Operating System
Date of Resolved Release
A security vulnerability in xscreensaver(1) may display portions of a locked desktop after being resized:
A security vulnerability in the xscreensaver(1) program may allow users with physical access to an X(5) display running the Xorg(1) X server (or Xnewt(1M) X server for Sun Ray servers) which has the X Resize and Rotate (RandR) extension loaded to be able to view portions of the locked screen.
2. Contributing Factors
This issue can occur in the following releases:
Note 2: This issue only affects systems configured to use the Xorg(1) X server (or Xnewt(1M) X server for Sun Ray servers). To determine which X Window System display server program (see Xserver(1)) is configured on a Solaris (non-Sun Ray server) system the following command can be run:
$ svcprop -p options/server svc:/application/x11/x11-serverTo determine which X Window System display server program (see Xserver(1)) is configured on a Sun Ray server the following command can be run:
$ /opt/SUNWut/bin/utxconfig -l |grep XSERVERNote 3: This issue only affects systems which have used the RandR extension to resize the screen (for example using the xrandr(1) utility). To determine if the RandR extension is loaded, the xdpyinfo(1) utility can be run:
$ xdpyinfo | grep RANDRNote 4: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -vNote 5: Only OpenSolaris installations that include the affected binary "/usr/X11/bin/xscreensaver", are impacted by this issue.
If the RandR extension has been used to increase the size of the screen, for example using xrandr(1), then xscreensaver(1) will only cover the original screen size.
To work around the described issue once the screen has been resized using the RandR extension, restarting xscreensaver(1) using the following command:
$ /usr/X11/bin/xscreensaver-command -restartwill resolve the issue.
This issue is addressed in the following releases:
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment