CVE-2006-1057

Published: Apr 25, 2006Modified: Apr 16, 2026

3.7

Vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Exploitability: 1.9 / Impact: 6.4

Source: NVD

Description

Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.

Affected (1)

Products: Gnome: Gdm

Gnome

1 product

Gdm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnome Gdm	Version 2.14

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (22)

http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1040

Source: secalert@redhat.com

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2006:083

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0286.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/17635

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/1465

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188303

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/26092

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10092

Source: secalert@redhat.com

https://usn.ubuntu.com/278-1/

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-announce-list/2006-April/msg00160.html

Source: secalert@redhat.com

Patch

http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261