CVE-2007-4569

Vulnerability

In KDE Display Manager (KDM) version 3.3.0 through 3.5.7, the backend/session.c file contains a password check bypass vulnerability [3]. When autologin is configured for at least one user and the "shutdown with password" option is enabled, an attacker can bypass the password requirement and log in as any user without providing credentials [2][4].

Exploitation

A local attacker with access to the KDM login screen can exploit this vulnerability. The attacker simply selects a target user (including root) and attempts to log in; due to the bug, the password check is skipped, allowing immediate access [2][4]. No special privileges or prior authentication are required.

Impact

Successful exploitation allows the attacker to log in as any user, including root, without supplying the correct password. This results in a full compromise of system confidentiality, integrity, and availability at the root privilege level [3][4].

Mitigation

Patches have been released for KDE 3.3.0–3.5.7; users should update to patched versions provided by their operating system vendors [1][3]. For KDE 3.5.0–3.5.7, apply post-3.5.7-kdebase-kdm.diff; for 3.3.0–3.4.2, apply post-3.4.2-kdebase-kdm.diff [3]. No workaround is known [4].