Date: Fri, 14 Nov 2003 01:17:48 -0800 From: Terry Lambert <tlambert2@mindspring.com> To: Craig Boston <craig@xfoil.gank.org> Cc: current@freebsd.org Subject: Re: xscreensaver bug? Message-ID: <3FB49DBC.C5FB385A@mindspring.com> References: <20031112091032.GA4425@cactus> <3FB3758A.9B52625D@mindspring.com> <200311130817.41809.craig@xfoil.gank.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Craig Boston wrote: > > Absolutely worst case, the root user could log in remotely, gdb > > your screen saver, type "foobar" as the password, and then hack > > the authentication function return value to say "yes, that's the > > correct password for "jqdkf@army.com", and get in without needing > > to have xscreensaver accept the root password. > > Or, even easier, log in remotely as root and simply "killall -9 xscreensaver". > I've had to do that a few times myself when I first tried out pam_krb5 and > learned the hard way that xscreensaver doesn't like it very much (and my user > account has * in the local password field). I've seen a kill of xscreensaver using a nontrappable signal leave the focus permanently hosed (until the X server is restarted); not very useful, if you want to poke around in the active session. -- Terry
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3FB49DBC.C5FB385A>