Read the docs
TI-2009-02579 Aliases CVE-2009-2697GHSA-vf98-38qc-3w28

The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat…

Priority LOW 34CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.

Why it matters now

EPSS 0.01841 79th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:*:*:*:*:*:*:*:*up to 2.16VulnerableGNOME
cpe:2.3:a:gnome:gdm:0.7:*:*:*:*:*:*:*0.7VulnerableGNOME
cpe:2.3:a:gnome:gdm:1.0:*:*:*:*:*:*:*1.0VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:*2.0VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:*2.2VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:*2.3VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:*2.4VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:*2.5VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:*2.6VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:*2.8VulnerableGNOME
  • cpe:2.3:a:gnome:gdm:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·GNOME
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:*2.13VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:*2.14VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:*2.15VulnerableGNOME
cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*5Running onRed Hat
  • cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:* Versions 2.13 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·GNOME
  • cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* Versions 5 Running on ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2009:1364 Released 2009-09-02 · Red Hat rating Low
    gdm security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) gdm-1:2.16.0-56.el5, gdm-1:2.16.0-56.el5.i386, gdm-1:2.16.0-56.el5.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) gdm-1:2.16.0-56.el5, gdm-1:2.16.0-56.el5.i386, gdm-docs-1:2.16.0-56.el5 +1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1364
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1364

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2697
  2. 2026-10-03 Alias added: GHSA-vf98-38qc-3w28

References

Advisory 1

Other 2

  • TI-2000-00491 Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote… CVSS 2.0HIGH 10.0
  • TI-2011-01488 GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a… CVSS 2.0HIGH 7.2
  • TI-2011-00635 GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership… CVSS 2.0MEDIUM 6.9
  • TI-2000-00503 libICE in XFree86 allows remote attackers to cause a denial of service by specifying a… CVSS 2.0MEDIUM 5.0
  • TI-2003-00517 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
  • TI-2003-00516 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences