CVE-2009-2697 Auth bypass in n/a

Medium 6.8 Published 4 Sep 2009 Updated 7 Aug 2024

Remote attackers can bypass access restrictions on XDMCP connections due to missing TCP Wrapper support in the GDM build script.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-2697?

CVE-2009-2697 is a medium-severity authentication bypass vulnerability in n/a, published on 4 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.

Weakness: CWE-287

Which versions are affected by CVE-2009-2697?

It affects 1 product.

Linux distribution packages (6)

`gdm` Red Hat:enterprise_linux:5::client	All versions	`1:2.16.0-56.el5`
`gdm-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`1:2.16.0-56.el5`
`gdm-docs` Red Hat:enterprise_linux:5::client	All versions	`1:2.16.0-56.el5`
`gdm` Red Hat:enterprise_linux:5::server	All versions	`1:2.16.0-56.el5`
`gdm-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`1:2.16.0-56.el5`
`gdm-docs` Red Hat:enterprise_linux:5::server	All versions	`1:2.16.0-56.el5`

Products include Gnome Gdm.

How do I fix CVE-2009-2697?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2009-2697 being exploited?

There is no known exploitation of CVE-2009-2697 in the wild and no public exploit code.

Sources

Also known as GHSA-vf98-38qc-3w28, RHSA-2009:1364.