CVE-2017-8900 - Vulnerability Details - OpenCVE

Description

LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session.

Published: 2017-05-12

Score: 4.6 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

AND

cpe:2.3:a:lightdm_project:lightdm:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:canonical:ubuntu_linux:16.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:17.04:::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2017-17840	LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session.
Ubuntu USN	USN-3285-1	LightDM vulnerability

No CVSS v4.0

No CVSS v3.1

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00049.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.securityfocus.com/bid/98554
https://launchpad.net/bugs/1663157
https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html
https://www.ubuntu.com/usn/usn-3285-1/

History

No history.

Subscriptions

Canonical Ubuntu Linux

Lightdm Project Lightdm

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-05-12T06:54:00.000Z

Updated: 2024-08-05T16:48:22.897Z

Reserved: 2017-05-11T00:00:00.000Z

Link: CVE-2017-8900

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-05-12T07:29:00.233

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-8900

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-05-12T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-05-24T09:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "98554", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/98554"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.ubuntu.com/usn/usn-3285-1/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://launchpad.net/bugs/1663157"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-8900", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "98554", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98554"}, {"name": "https://www.ubuntu.com/usn/usn-3285-1/", "refsource": "CONFIRM", "url": "https://www.ubuntu.com/usn/usn-3285-1/"}, {"name": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html", "refsource": "CONFIRM", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html"}, {"name": "https://launchpad.net/bugs/1663157", "refsource": "CONFIRM", "url": "https://launchpad.net/bugs/1663157"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:48:22.897Z"}, "title": "CVE Program Container", "references": [{"name": "98554", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/98554"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ubuntu.com/usn/usn-3285-1/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://launchpad.net/bugs/1663157"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-8900", "datePublished": "2017-05-12T06:54:00.000Z", "dateReserved": "2017-05-11T00:00:00.000Z", "dateUpdated": "2024-08-05T16:48:22.897Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lightdm_project:lightdm:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CAC5354-FCCB-416A-A00F-7C337EF9099F", "versionEndIncluding": "1.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*", "matchCriteriaId": "1AFB20FA-CB00-4729-AB3A-816454C6D096", "vulnerable": false}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*", "matchCriteriaId": "588D4F37-0A56-47A4-B710-4D5F3D214FB9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session."}, {"lang": "es", "value": "LightDM hasta la versi\u00f3n 1.22.0, cuando es usado systemd en Ubuntu versi\u00f3n 16.10 y versiones 17.x, permite a los atacantes f\u00edsicamente cercanos omitir las restricciones previstas de AppArmor y visitar los directorios principales de usuarios arbitrarios mediante el establecimiento de una sesi\u00f3n de invitado."}], "id": "CVE-2017-8900", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-12T07:29:00.233", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98554"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://launchpad.net/bugs/1663157"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ubuntu.com/usn/usn-3285-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98554"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://launchpad.net/bugs/1663157"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ubuntu.com/usn/usn-3285-1/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}