Xdm May Open Random TCP Sockets
|
|
SecurityTracker Alert ID: 1010306 |
|
SecurityTracker URL: http://securitytracker.com/id/1010306
|
|
CVE Reference:
CVE-2004-0419
(Links to External Site)
|
Updated: Oct 4 2004
|
Original Entry Date: May 27 2004
|
Impact:
User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in xdm. The software may open random TCP sockets.
Steve Rumble reported that xdm opens a chooserFd TCP socket even when DisplayManager.requestPort is set to 0.
The flaw resides in 'xc/programs/xdm/socket.c'.
|
Impact:
The software may open random TCP ports.
|
Solution:
The vendor has issued a patch (/cvs/xc/programs/xdm/socket.c), available via CVS.
|
Vendor URL: bugs.xfree86.org/show_bug.cgi?id=1376 (Links to External Site)
|
Cause:
Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Subject: http://bugs.xfree86.org/show_bug.cgi?id=1376
|
http://bugs.xfree86.org/show_bug.cgi?id=1376
Bugzilla Bug 1376
xdm opens random tcp sockets Last modified: 2004-05-19 22:25
--------------------------------------------------------------------------------
Description: Opened: 2004-05-19 21:44
Even when DisplayManager.requestPort is set to 0, xdm will open a chooserFd tcp
socket on all interfaces. This apparently cannot be disabled by configuration
and presents a possible security risk. Older versions of xdm/socket.c appear to
have checked and aborted if request_port == 0, but the current one does not.
Perhaps it was mistakenly forgotten while refactoring the code.
The following patch should resolve the issue:
Index: socket.c
===================================================================
RCS file: /cvs/xc/programs/xdm/socket.c,v
retrieving revision 3.16
diff -u -r3.16 socket.c
--- socket.c 30 Mar 2004 17:22:46 -0000 3.16
+++ socket.c 20 May 2004 01:33:02 -0000
@@ -66,6 +66,9 @@
char *name = localHostname ();
registerHostname (name, strlen (name));
+ if (request_port == 0)
+ return;
+
#if defined(IPv6) && defined(AF_INET6)
chooserFd = socket (AF_INET6, SOCK_STREAM, 0);
if (chooserFd < 0)
------- Additional Comment #1 From dawes@xfree86.org 2004-05-19 22:25 -------
committed -- thanks.
|
|
