Security hole in XFree86

    Date07 Dec 1999
    CategorySuSE
    3470
    Posted ByLinuxSecurity Advisories
    XFree86 creates a directory in /tmp with the name .X11-unix for the X sockets and sets the directory to mode 1777. If an attacker creates a symlink with that filename and points it to another directory (e.g. /root), the permissions of the target directory is set to 1777.
    ______________________________________________________________________________
    
                            SuSE Security Announcement
    
            Package:  xf86-3.3.3-5
            Date:     Sun Mar 28 12:26:39 CEST 1999
            Affected: unix operating systems using xfree86
    
    ______________________________________________________________________________
    
    A security hole was discovered in the package mentioned above.
    Please update as soon as possible or disable the service if you are using
    this software on your SuSE Linux installation(s).
    
    Other Linux distributions or operating systems might be affected as
    well, please contact your vendor for information about this issue.
    
    Thanks to the people from bugtraq for providing the details of this
    vulnerability and especially the XFree86 programmers who made a fix
    ready over the weekend.
    
    Please note, that we provide this information on as "as-is" basis only.
    There is no warranty whatsoever and no liability for any direct, indirect or
    incidental damage arising from this information or the installation of
    the update package.
    ______________________________________________________________________________
    
    1. Problem Description
    
        XFree86 creates a directory in /tmp with the name .X11-unix for
        the X sockets and sets the directory to mode 1777.
        If an attacker creates a symlink with that filename and points
        it to another directory (e.g. /root), the permissions of the target
        directory is set to 1777.
    
    2. Impact
    
        A local attacker may create files with any contents in any directory.
    
    3. Solution
    
        Upgrade your XF86.
    
        As a temporary fix you can put these commands into /sbin/init.d/boot.local:
    
    	/bin/rm -rf /tmp/.X11-unix
    	mkdir -p -m 1777 /tmp/.X11-unix
    
    ______________________________________________________________________________
    
    Here are the md5 checksums of the upgrade packages, please verify these
    before installing the new packages:
    
    glibc archives (SuSE 6.0):
    d2bb4132bc487debea45288f8199e1e7  x8514-3.3.3.1-13.i386.rpm
    5f5b6a53027d54cb9df4cafcb284d720  xagx-3.3.3.1-13.i386.rpm
    0c651985aa39750ed787df42c9dc49f7  xfbdev-3.3.3.1-13.i386.rpm
    7353be5812375a350c7499e4bb4f7781  xglint-3.3.3.1-13.i386.rpm
    88182f0e22ed3f4f564d0f678dc37ffe  xi128-3.3.3.1-13.i386.rpm
    492ddd01dd10dcb83d2cbf5995b7396b  xlkit-3.3.3.1-13.i386.rpm
    5779042312519b30e214d8aa4b9c2313  xmach32-3.3.3.1-13.i386.rpm
    9fee0e2a4bcf4fbaa91759bc004faf88  xmach64-3.3.3.1-13.i386.rpm
    338041da9001b5e36c55f9ffa6209613  xmach8-3.3.3.1-13.i386.rpm
    68124d6e36cc48396aad4e395cb9567b  xmono-3.3.3.1-13.i386.rpm
    ea4c0301ee8f33339f5908d82a4b271d  xp9k-3.3.3.1-13.i386.rpm
    d219a182a79723b258b28f87bc22ee68  xs3-3.3.3.1-13.i386.rpm
    d8ad0f9b0d57f887cc076e794a749738  xs3v-3.3.3.1-13.i386.rpm
    ff0c37343e5bd30261ab7f05604ea6e7  xsvga-3.3.3.1-13.i386.rpm
    e151bf1ed2d6c9824b2c521dcf2f7141  xvga16-3.3.3.1-13.i386.rpm
    9099ebe5428098f8ffacd1ab691b5937  xw32-3.3.3.1-13.i386.rpm
    5627fc4da2eab1f56a9e636374982ede  xxprt-3.3.3.1-13.i386.rpm
    
    libc5 archives (SuSE <= 5.3):
    cfe392df95404f0a223b8c983ee51ce1  x8514-3.3.3.1-13.i386.rpm
    4fd3a27e24b6947ef62231cc4b5630dd  xagx-3.3.3.1-13.i386.rpm
    71e1f6bef32e321b997db67d87c3c20a  xdevel-3.3.3.1-13.i386.rpm
    944e63a37139bcaeffcfa85010567d39  xdoc-3.3.3.1-13.i386.rpm
    0a6a5de750c11bf35b01744319abfd01  xextra-3.3.3.1-13.i386.rpm
    324a7e56c0a46685fb26b802167d79d5  xf86-3.3.3.1-13.i386.rpm
    a8a337baf2a85195e981eca2eaf3c855  xfbdev-3.3.3.1-13.i386.rpm
    67a410a1c051eb70fa3e59935b50ec75  xfnt100-3.3.3.1-13.i386.rpm
    436ce9d44dd875235d5ffd6eb0d5d07c  xfntbig-3.3.3.1-13.i386.rpm
    21ce9773f7782680bd1142c884c5e77b  xfntcyr-3.3.3.1-13.i386.rpm
    0e04aed9a681d142a4a912d365e57471  xfntscl-3.3.3.1-13.i386.rpm
    12ffe00734e870c0a9a54fe87b13406b  xfsetup-3.3.3.1-13.i386.rpm
    289216e84448c380341f44796e8e1338  xglint-3.3.3.1-13.i386.rpm
    43b1a9da5447b4ac7eac5d2f1501b313  xi128-3.3.3.1-13.i386.rpm
    6626e4404dc0d7bc2f88b3b83f8ce136  xlkit-3.3.3.1-13.i386.rpm
    ab461815a023185f6266d9901e92b6b8  xmach32-3.3.3.1-13.i386.rpm
    bf28d6eb8bd8a9a4b37e5fe0b71c4597  xmach64-3.3.3.1-13.i386.rpm
    b07d322b63b4dc1f0810612907caaaa0  xmach8-3.3.3.1-13.i386.rpm
    7a56420b929cb1b3e8507d9b3b36b287  xman-3.3.3.1-13.i386.rpm
    494687ca8adbebaf213eee10f4be290c  xmono-3.3.3.1-13.i386.rpm
    1cad4cdd644d4f17f4f936f5c2d95ff6  xp9k-3.3.3.1-13.i386.rpm
    39683c93132a16f0e79fc414bfb338f1  xs3-3.3.3.1-13.i386.rpm
    7a2707ff0cb3ee59d3695f01256c1484  xs3v-3.3.3.1-13.i386.rpm
    5c0d05b4b1a53f039c35623c1669eb0f  xshared-3.3.3.1-13.i386.rpm
    cb707a8c22b77478236a81bc58f5edfa  xsvga-3.3.3.1-13.i386.rpm
    e1083e3e18f5a5aeb8de1aff93bd9026  xvga16-3.3.3.1-13.i386.rpm
    bb74f0e93121a8747e8c38bf1e0121e0  xw32-3.3.3.1-13.i386.rpm
    1d38958dd9ac4fbdd1ccef960667ab45  xxprt-3.3.3.1-13.i386.rpm
    
    ______________________________________________________________________________
    
    You will find the updates on our ftp-Server:
    
    SuSE 6.0:
     ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/XFree86-3.3.3.1-SuSE/glibc
    
    SuSE <= 5.3:
     ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/XFree86-3.3.3.1-SuSE/libc5
    
    Webpage for patches:
            http://www.suse.de/patches/index.html
    
    or try the following web pages for a list of mirrors:
    
            http://www.suse.de/ftp.html
            http://www.suse.com/ftp_new.html
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.