Quantum Secular Labs / Blog / Advisories

CVE-2000-0491: Gnome Gdm: Command injection

CVE-2000-0491 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Gnome Gdm, along with 2 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Gnome Gdm: 1.0
  • Caldera Openlinux: all versions listed by NVD
  • Suse Linux: 6.2; 6.4

References