CVE-2007-3920 Security feature bypass in n/a

Medium 6.2 Published 29 Oct 2007 Updated 7 Aug 2024

Attackers with physical access can bypass the screensaver lock by using Alt-Tab in Compiz, gaining control of the user session.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2007-3920?

CVE-2007-3920 is a medium-severity vulnerability in n/a, published on 29 Oct 2007. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069.

Which versions are affected by CVE-2007-3920?

It affects 2 products.

Linux distribution packages (8)

`compiz` Red Hat:enterprise_linux:5::client	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz` Red Hat:rhel_productivity:5	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz-debuginfo` Red Hat:rhel_productivity:5	All versions	`0:0.0.13-0.37.20060817git.el5`
`compiz-devel` Red Hat:rhel_productivity:5	All versions	`0:0.0.13-0.37.20060817git.el5`

Products include Compiz Compiz, Gnome Screensaver.

How do I fix CVE-2007-3920?

Apply the vendor's patch.

Is CVE-2007-3920 being exploited?

There is no known exploitation of CVE-2007-3920 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2007-3920, DTSA-75-1, GHSA-pq79-5jg4-62p2, RHSA-2008:0485.