Published: 12/02/2019 Updated: 16/03/2021

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

In pam/gkr-pam-module.c in GNOME Keyring prior to 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome gnome keyring
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
oracle zfs storage appliance kit 8.8

GNOME Keyring could be made to expose sensitive information ...

In pam/gkr-pam-modulec in GNOME Keyring before 3272, the user's password is kept in a session-child process spawned from the LightDM daemon This can expose the credential in cleartext ...

A tool to dump the login password from the current linux user

MimiPenguin 20 A tool to dump the login password from the current linux desktop user Adapted from the idea behind the popular Windows tool mimikatz This was assigned CVE-2018-20781 (cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2018-20781) Fun fact it's still not fixed after GNOME Keyring 3272 and still works as of 32802-1ubuntu118041 Details Takes advan

CWE-522 https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2 https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3 https://bugzilla.gnome.org/show_bug.cgi?id=781486 https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 https://usn.ubuntu.com/3894-1/https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da https://github.com/huntergregal/mimipenguin https://www.oracle.com/security-alerts/cpujan2021.html https://usn.ubuntu.com/3894-1/https://nvd.nist.gov

CVE-2018-20781

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect