Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   Xdm Vendors:   XFree86 Project
Xdm May Open Random TCP Sockets
SecurityTracker Alert ID:  1010306
SecurityTracker URL:
CVE Reference:   CVE-2004-0419   (Links to External Site)
Updated:  Oct 4 2004
Original Entry Date:  May 27 2004
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in xdm. The software may open random TCP sockets.

Steve Rumble reported that xdm opens a chooserFd TCP socket even when DisplayManager.requestPort is set to 0.

The flaw resides in 'xc/programs/xdm/socket.c'.

Impact:   The software may open random TCP ports.
Solution:   The vendor has issued a patch (/cvs/xc/programs/xdm/socket.c), available via CVS.
Vendor URL: (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 27 2004 (OpenBSD Issues Fix) Xdm May Open Random TCP Sockets
OpenBSD has issued a fix.
Jul 28 2004 (Mandrake Issues Fix) Xdm May Open Random TCP Sockets
Mandrake has issued a fix.
Oct 4 2004 (Red Hat Issues Fix for XFree86 on RHEL) Xdm May Open Random TCP Sockets
Red Hat has released a fix for XFree86 for Red Hat Enterprise Linux 3.

 Source Message Contents


Bugzilla Bug 1376
    xdm opens random tcp sockets Last modified: 2004-05-19 22:25

Description:    Opened: 2004-05-19 21:44

Even when DisplayManager.requestPort is set to 0, xdm will open a chooserFd tcp
socket on all interfaces. This apparently cannot be disabled by configuration
and presents a possible security risk. Older versions of xdm/socket.c appear to
have checked and aborted if request_port == 0, but the current one does not.
Perhaps it was mistakenly forgotten while refactoring the code.

The following patch should resolve the issue:

Index: socket.c
RCS file: /cvs/xc/programs/xdm/socket.c,v
retrieving revision 3.16
diff -u -r3.16 socket.c
--- socket.c    30 Mar 2004 17:22:46 -0000      3.16
+++ socket.c    20 May 2004 01:33:02 -0000
@@ -66,6 +66,9 @@
      char *name = localHostname ();
      registerHostname (name, strlen (name));

+    if (request_port == 0)
+       return;
  #if defined(IPv6) && defined(AF_INET6)
      chooserFd = socket (AF_INET6, SOCK_STREAM, 0);
      if (chooserFd < 0)

------- Additional Comment #1 From 2004-05-19 22:25 -------
committed -- thanks.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC