SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   Xdm Vendors:   XFree86 Project
Xdm May Open Random TCP Sockets
SecurityTracker Alert ID:  1010306
SecurityTracker URL:  http://securitytracker.com/id/1010306
CVE Reference:   CAN-2004-0419   (Links to External Site)
Updated:  Oct 4 2004
Original Entry Date:  May 27 2004
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in xdm. The software may open random TCP sockets.

Steve Rumble reported that xdm opens a chooserFd TCP socket even when DisplayManager.requestPort is set to 0.

The flaw resides in 'xc/programs/xdm/socket.c'.

Impact:   The software may open random TCP ports.
Solution:   The vendor has issued a patch (/cvs/xc/programs/xdm/socket.c), available via CVS.
Vendor URL:  bugs.xfree86.org/show_bug.cgi?id=1376 (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 27 2004 (OpenBSD Issues Fix) Xdm May Open Random TCP Sockets
OpenBSD has issued a fix.
Jul 28 2004 (Mandrake Issues Fix) Xdm May Open Random TCP Sockets
Mandrake has issued a fix.
Oct 4 2004 (Red Hat Issues Fix for XFree86 on RHEL) Xdm May Open Random TCP Sockets
Red Hat has released a fix for XFree86 for Red Hat Enterprise Linux 3.



 Source Message Contents

Subject:  http://bugs.xfree86.org/show_bug.cgi?id=1376


http://bugs.xfree86.org/show_bug.cgi?id=1376

Bugzilla Bug 1376
    xdm opens random tcp sockets Last modified: 2004-05-19 22:25

--------------------------------------------------------------------------------
Description:    Opened: 2004-05-19 21:44

Even when DisplayManager.requestPort is set to 0, xdm will open a chooserFd tcp
socket on all interfaces. This apparently cannot be disabled by configuration
and presents a possible security risk. Older versions of xdm/socket.c appear to
have checked and aborted if request_port == 0, but the current one does not.
Perhaps it was mistakenly forgotten while refactoring the code.

The following patch should resolve the issue:

Index: socket.c
===================================================================
RCS file: /cvs/xc/programs/xdm/socket.c,v
retrieving revision 3.16
diff -u -r3.16 socket.c
--- socket.c    30 Mar 2004 17:22:46 -0000      3.16
+++ socket.c    20 May 2004 01:33:02 -0000
@@ -66,6 +66,9 @@
      char *name = localHostname ();
      registerHostname (name, strlen (name));

+    if (request_port == 0)
+       return;
+
  #if defined(IPv6) && defined(AF_INET6)
      chooserFd = socket (AF_INET6, SOCK_STREAM, 0);
      if (chooserFd < 0)

------- Additional Comment #1 From dawes@xfree86.org 2004-05-19 22:25 -------
committed -- thanks.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, SecurityGlobal.net LLC