desktop-packages team mailing list archive

[Sam <1396151@xxxxxxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

On a system upgraded from 12.04 to 14.04:

When "don't ask for password on login" is checked for a user, previous
screen locking would still require a password - the preference only
applied to logins.

Now light locker(?) is showing a password dialog box, but it will accept
any (or no) password for screen unlock, just as for login.

This might be a good change, but it was surely unexpected, and I found
the previous functionality (being able to NOT require the PW for login
but still require it for screen unlock) very useful, even if it might
seem odd on the surface.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: gnome-screensaver (not installed)
ProcVersionSignature: Ubuntu 3.13.0-39.66-generic 3.13.11.8
Uname: Linux 3.13.0-39-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.5
Architecture: amd64
CurrentDesktop: XFCE
Date: Tue Nov 25 08:29:52 2014
InstallationDate: Installed on 2012-10-08 (777 days ago)
InstallationMedia: Xubuntu 12.04.1 LTS "Precise Pangolin" - Release amd64 (20120822.1)
SourcePackage: gnome-screensaver
Symptom: security
Title: Screen locking issue
UpgradeStatus: Upgraded to trusty on 2014-09-03 (83 days ago)

** Affects: gnome-screensaver (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: amd64 apport-bug trusty

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to gnome-screensaver in Ubuntu.
https://bugs.launchpad.net/bugs/1396151

Title:
  password not checked on screen unlock

Status in “gnome-screensaver” package in Ubuntu:
  New

Bug description:
  On a system upgraded from 12.04 to 14.04:

  When "don't ask for password on login" is checked for a user, previous
  screen locking would still require a password - the preference only
  applied to logins.

  Now light locker(?) is showing a password dialog box, but it will
  accept any (or no) password for screen unlock, just as for login.

  This might be a good change, but it was surely unexpected, and I found
  the previous functionality (being able to NOT require the PW for login
  but still require it for screen unlock) very useful, even if it might
  seem odd on the surface.

  ProblemType: Bug
  DistroRelease: Ubuntu 14.04
  Package: gnome-screensaver (not installed)
  ProcVersionSignature: Ubuntu 3.13.0-39.66-generic 3.13.11.8
  Uname: Linux 3.13.0-39-generic x86_64
  ApportVersion: 2.14.1-0ubuntu3.5
  Architecture: amd64
  CurrentDesktop: XFCE
  Date: Tue Nov 25 08:29:52 2014
  InstallationDate: Installed on 2012-10-08 (777 days ago)
  InstallationMedia: Xubuntu 12.04.1 LTS "Precise Pangolin" - Release amd64 (20120822.1)
  SourcePackage: gnome-screensaver
  Symptom: security
  Title: Screen locking issue
  UpgradeStatus: Upgraded to trusty on 2014-09-03 (83 days ago)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1396151/+subscriptions