** Changed in: arctica-greeter (Ubuntu)
Status: In Progress => Fix Committed
** Changed in: marco (Ubuntu)
Status: In Progress => Fix Committed
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to lightdm in Ubuntu.
https://bugs.launchpad.net/bugs/1948339
Title:
Logon screen can be bypassed using various shortcuts
Status in arctica-greeter package in Ubuntu:
Fix Committed
Status in lightdm package in Ubuntu:
Invalid
Status in marco package in Ubuntu:
Fix Committed
Status in mate-settings-daemon package in Ubuntu:
Invalid
Bug description:
Hi,
my little daughter discovered a logon screen bypass in Ubuntu Mate
21.10 after hitting the keyboard for a while.
It turns out that several keyboard shortcuts are allowed while Ubuntu
Mate is locked (arctica-greeter):
- Mod4 + S (mate-search-tool)
- Mod4 + E (Open Caja / File Explorer)
- CTRL + Shift + Esc (mate-system-monitor)
- PRNT (Screenshot)
All of the mentioned shortcuts could be used to spawn a file explorer
(Caja) or various other binaries as user "lightdm", who owns the logon
screen.
Although an interactive terminal like mate-terminal, xterm, lxterm
etc. could not be opened directly, there are various options to run
commands as the lightdm user, for example by creating a shell script
using "caja", and execute it directly using the GUI.
I've attached Proof-of-Concept GIFs for all shortcuts mentioned above.
There might be additional shortcuts that could be used to achieve the
same, however I'm not aware about every shortcut that is configured,
but I suppose that the root cause is located somewhere in arctica-
greeter, rather than within every single binary launched by shortcuts.
The bug was reproduced on a fresh installation of Ubuntu Mate 21.10. I
haven't tested other versions of Ubuntu Mate yet.
Please find additional version details below:
$ apt-cache policy lightdm
lightdm:
Installed: 1.30.0-0ubuntu4
Candidate: 1.30.0-0ubuntu4
Version table:
*** 1.30.0-0ubuntu4 500
500 http://de.archive.ubuntu.com/ubuntu impish/universe amd64 Packages
100 /var/lib/dpkg/status
$ apt-cache policy arctica-greeter
arctica-greeter:
Installed: 0.99.1.5-2nmu1
Candidate: 0.99.1.5-2nmu1
Version table:
*** 0.99.1.5-2nmu1 500
500 http://de.archive.ubuntu.com/ubuntu impish/universe amd64 Packages
100 /var/lib/dpkg/status
Thanks,
Basti
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/arctica-greeter/+bug/1948339/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
