Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006:13] xorg privilege escalation and DoS

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006:13] xorg privilege escalation and DoS
  • Date: Tue, 21 Mar 2006 20:05:49 +0100

When parsing arguments, the server takes care to check that only root
can pass the options -modulepath, which determines the location to load
many modules providing server functionality from, and -logfile, which
determines the location of the logfile. Normally, these locations
cannot be changed by unprivileged users.

This test was changed to test the effective UID as well as the real UID
in X.Org. The test is defective in that it tested the address of the
geteuid function, not the result of the function itself. As a result,
given that the address of geteuid() is always non-zero, an unpriviliged
user can load modules from any location on the filesystem with root
privileges, or overwrite critical system files with the server log.

For more details, see
http://lists.freedesktop.org/archives/xorg/2006-March/013992.html

---
This applies to stable-rc and test grimoires. The version of xorg in the
stable grimoire is not affected.
Systems using stable-rc or test grimoire should update their xorg
installation:
# scribe update
# cast -c xorg

or

# scribe update
# sorcery queue-security
# cast --queue

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org



  • [SM-Security] [SMGLSA-2006:13] xorg privilege escalation and DoS, Arwed von Merkatz, 03/21/2006

Archive powered by MHonArc 2.6.24.

Top of Page