受影响系统： 

RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux AS 3 RedHat Enterprise Linux AS 2.1 Jamie Zawinski XScreenSaver 4.17 Jamie Zawinski XScreenSaver 4.16 Jamie Zawinski XScreenSaver 4.14 AVAYA Interactive Response 1.3 AVAYA Interactive Response 1.2.1 AVAYA Integrated Management 2.1

不受影响系统： 

Jamie Zawinski XScreenSaver 4.18

描述：

BUGTRAQ  ID: 17471 CVE(CAN) ID: CVE-2004-2655 XScreenSaver是X窗口系统的一套屏保程序和屏保框架。 XScreenSaver提示用户输入口令解锁屏幕时存在键盘焦点漏洞。XScreenSaver没有正确的保证拥有正确的键盘焦点，这可能将用户口令泄漏给有键盘焦点的程序。这种行为并不常见，因为仅有一些应用程序出现这种焦点错误。 <*链接：http://marc.theaimsgroup.com/?l=bugtraq&m=114962062927164&w=2         http://secunia.com/advisories/20226/print/         http://lwn.net/Alerts/184909 *>

建议：

厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2006:0498-01）以及相应补丁: RHSA-2006:0498-01：Moderate: xscreensaver security update 链接：http://lwn.net/Alerts/184909 补丁下载： Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/xscreensaver-3.33-4.rhel21.3.src.rpm f8a3f186605e8c1e94118d560724cd0c  xscreensaver-3.33-4.rhel21.3.src.rpm i386: 3f48fa1db2d0c4224dd968a3a4a10033  xscreensaver-3.33-4.rhel21.3.i386.rpm ia64: dfe54c3a32cc18cd4cdf4ccfe073cba0  xscreensaver-3.33-4.rhel21.3.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/xscreensaver-3.33-4.rhel21.3.src.rpm f8a3f186605e8c1e94118d560724cd0c  xscreensaver-3.33-4.rhel21.3.src.rpm ia64: dfe54c3a32cc18cd4cdf4ccfe073cba0  xscreensaver-3.33-4.rhel21.3.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/xscreensaver-3.33-4.rhel21.3.src.rpm f8a3f186605e8c1e94118d560724cd0c  xscreensaver-3.33-4.rhel21.3.src.rpm i386: 3f48fa1db2d0c4224dd968a3a4a10033  xscreensaver-3.33-4.rhel21.3.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/xscreensaver-3.33-4.rhel21.3.src.rpm f8a3f186605e8c1e94118d560724cd0c  xscreensaver-3.33-4.rhel21.3.src.rpm i386: 3f48fa1db2d0c4224dd968a3a4a10033  xscreensaver-3.33-4.rhel21.3.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/xscreensaver-4.10-20.src.rpm aeb44a2230e0891747e7c678e165c2b0  xscreensaver-4.10-20.src.rpm i386: 32064f1c5108a2fc8d440099113a915f  xscreensaver-4.10-20.i386.rpm c3c5cbe5a9f4dc689ba1cc8168dfda10  xscreensaver-debuginfo-4.10-20.i386.rpm ia64: ac46f647bd7930f3dcf10b74d4f8f9ec  xscreensaver-4.10-20.ia64.rpm ebf73db97fdda4f4d65e6897050ca206  xscreensaver-debuginfo-4.10-20.ia64.rpm ppc: 6023bea1b1145194a72487f7418b9c8b  xscreensaver-4.10-20.ppc.rpm fcb479f611c9053efd9d845bcdbc7ffe  xscreensaver-debuginfo-4.10-20.ppc.rpm s390: 0e9f6a02afe107a9b52334eb89c0a0b1  xscreensaver-4.10-20.s390.rpm 26f350733c38fc054ea14b3cf8f08b77  xscreensaver-debuginfo-4.10-20.s390.rpm s390x: e48435174e377c0c7b78b2f87c16aab5  xscreensaver-4.10-20.s390x.rpm 7772d366de77b390edd9e3593b1d6d5b  xscreensaver-debuginfo-4.10-20.s390x.rpm x86_64: 83193c35d8ddf707af150d1e507fdc61  xscreensaver-4.10-20.x86_64.rpm 0177ce9d9a124b43310f450212ef271a  xscreensaver-debuginfo-4.10-20.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/xscreensaver-4.10-20.src.rpm aeb44a2230e0891747e7c678e165c2b0  xscreensaver-4.10-20.src.rpm i386: 32064f1c5108a2fc8d440099113a915f  xscreensaver-4.10-20.i386.rpm c3c5cbe5a9f4dc689ba1cc8168dfda10  xscreensaver-debuginfo-4.10-20.i386.rpm x86_64: 83193c35d8ddf707af150d1e507fdc61  xscreensaver-4.10-20.x86_64.rpm 0177ce9d9a124b43310f450212ef271a  xscreensaver-debuginfo-4.10-20.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/xscreensaver-4.10-20.src.rpm aeb44a2230e0891747e7c678e165c2b0  xscreensaver-4.10-20.src.rpm i386: 32064f1c5108a2fc8d440099113a915f  xscreensaver-4.10-20.i386.rpm c3c5cbe5a9f4dc689ba1cc8168dfda10  xscreensaver-debuginfo-4.10-20.i386.rpm ia64: ac46f647bd7930f3dcf10b74d4f8f9ec  xscreensaver-4.10-20.ia64.rpm ebf73db97fdda4f4d65e6897050ca206  xscreensaver-debuginfo-4.10-20.ia64.rpm x86_64: 83193c35d8ddf707af150d1e507fdc61  xscreensaver-4.10-20.x86_64.rpm 0177ce9d9a124b43310f450212ef271a  xscreensaver-debuginfo-4.10-20.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/xscreensaver-4.10-20.src.rpm aeb44a2230e0891747e7c678e165c2b0  xscreensaver-4.10-20.src.rpm i386: 32064f1c5108a2fc8d440099113a915f  xscreensaver-4.10-20.i386.rpm c3c5cbe5a9f4dc689ba1cc8168dfda10  xscreensaver-debuginfo-4.10-20.i386.rpm ia64: ac46f647bd7930f3dcf10b74d4f8f9ec  xscreensaver-4.10-20.ia64.rpm ebf73db97fdda4f4d65e6897050ca206  xscreensaver-debuginfo-4.10-20.ia64.rpm x86_64: 83193c35d8ddf707af150d1e507fdc61  xscreensaver-4.10-20.x86_64.rpm 0177ce9d9a124b43310f450212ef271a  xscreensaver-debuginfo-4.10-20.x86_64.rpm 可使用下列命令安装补丁： rpm -Fvh [文件名] Jamie Zawinski -------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.jwz.org/xscreensaver/xscreensaver-4.24.tar.gz