CVE-2013-4509

The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html
https://bugzilla.redhat.com/show_bug.cgi?id=1027028
https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozc_support_ibus-1.5.4_rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690	Patch
https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a5edfe7	Patch
https://groups.google.com/forum/#%21topic/ibus-user/mvCHDO1BJUw

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibus_project:ibus::::::::
	cpe:2.3:a:ibus_project:ibus:1.5.4:::::::*

Configuration 2 (hide)

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

History

13 Feb 2023, 04:47

Type	Values Removed	Values Added
References	~~{'url': 'https://groups.google.com/forum/#!topic/ibus-user/mvCHDO1BJUw', 'name': 'https://groups.google.com/forum/#!topic/ibus-user/mvCHDO1BJUw', 'tags': [], 'refsource': 'MISC'}~~	(MISC) https://groups.google.com/forum/#%21topic/ibus-user/mvCHDO1BJUw -

Information

Published : 2013-11-23 19:55

Updated : 2023-12-10 11:16

NVD link : CVE-2013-4509

Mitre link : CVE-2013-4509

CVE.ORG link : CVE-2013-4509

JSON object : View

Products Affected

opensuse

opensuse

ibus_project

ibus

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2013-4509", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-11-23T19:55:03.613", "references": [{"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html", "source": "secalert@redhat.com"}, {"url": "http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html", "source": "secalert@redhat.com"}, {"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1027028", "source": "secalert@redhat.com"}, {"url": "https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozc_support_ibus-1.5.4_rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a5edfe7", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "https://groups.google.com/forum/#%21topic/ibus-user/mvCHDO1BJUw", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen."}, {"lang": "es", "value": "La configuraci\u00f3n predeterminada de IBUS 1.5.4, y posiblemente de 1.5.2 y anteriores, cuando IBus.InputPurpose.PASSWORD no se establece y utiliza con GNOME 3, no oscurece los caracteres escritos, lo que permite a atacantes f\u00edsicamente pr\u00f3ximos obtener una contrase\u00f1a de usuario mediante la lectura de la pantalla de bloqueo."}], "lastModified": "2023-02-13T04:47:03.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibus_project:ibus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E220A758-86E2-40F7-8E9E-89DBF26C1778", "versionEndIncluding": "1.5.2"}, {"criteria": "cpe:2.3:a:ibus_project:ibus:1.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D52B705-2959-4021-8AC8-E52D58FE3C54"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}