FreeBSD-SA-01:01.openssh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:01 Security Advisory FreeBSD, Inc. Topic: Hostile server OpenSSH agent/X11 forwarding Category: core/ports Module: openssh Announced: 2001-01-15 Credits: Markus Friedl...

CVE-2000-1169

OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent...

PT-2001-1205 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 2.3.0 Description: The issue allows a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent, due to improper disabling of X11 or agent forwarding in the OpenSSH...

gtk+ security hole.

while going through a quick audit of gtk i found: gtk+ can be tricked into running arbitrary code via a bogus module. this means any program using gtk that is setid can be exploited via this method. here is an exploit i wrote for this security hole: original xgtk.cworking/un-wrapped:...

openssh.forwarding.txt

Hostile servers can force OpenSSH clients to do agent or X11 forwarding 1. Systems affected: All versions of OpenSSH prior to 2.3.0 are affected. 2. Description: If agent or X11 forwarding is disabled in the ssh client configuration, the client does not request these features during session setup...

OpenSSH Security Advisory (adv.fwd)

Hostile servers can force OpenSSH clients to do agent or X11 forwarding 1. Systems affected: All versions of OpenSSH prior to 2.3.0 are affected. 2. Description: If agent or X11 forwarding is disabled in the ssh client configuration, the client does not request these features during session setup...

Дырка в OpenSSH-клиенте (X11-forwarding)

Сервер может затребовать передачу X11-сообщений, таким образом перезватывать все события в сеансе клиента...

X Server Detection

The remote host is running an X11 server. X11 is a client-server protocol that can be used to display graphical applications running on a given host on a remote client. Since the X11 traffic is not ciphered, it is possible for an attacker to eavesdrop on the connection. C Tenable Network Security...

Solaris 7.0/8 - Xsun Buffer Overrun

// source: https://www.securityfocus.com/bid/1140/info A buffer overrun vulnerability exists in the Xsun X11 server, as shipped as part of Solaris 7 and 8 from Sun Microsystems. By supplying a long argument to the -dev option normally used to set the output device, it is possible to execute...

ssh-xauth.txt

The default SSH configuration for SSH1 and SSH2 allow for remote controlling of X sessions through X forwarding. All children of the SSH connection are able to tunnel X11 sessions through the X tunnel to the client X11 session. This is accomplished by running xauth upon logging in. If xauth is...

X11.tmp.txt

Date: Mon, 2 Nov 1998 23:04:43 +0100 From: Pavel Kankovsky To: [email protected] Subject: X11 cookie hijacker drwxrwxrwx 2 root root 1024 Oct 30 19:57 /tmp/.X11-unix Hang on, aren't those dangerous permissions? Pretty dangerous. Shall I look for my old cookie hijacker? Please post the bloody...

X11R6 3.3.3 - Symlink

X11R6 3.3.3 - Symlink // source: https://www.securityfocus.com/bid/326/info There is a symlink vulnerability known to exist under most modern linux and NetBSD distributions. It involves /tmp/.X11-unix and the tendency to follow to/overwrite the file pointed to if a symlink. It may be possible for...

X11 Keylogger

This module binds to an open X11 host to log keystrokes. This is a fairly close copy of the old xspy c program which has been on Kali for a long time. The module works by connecting to the X11 session, creating a background window, binding a keyboard to it and creating a notification alert when a...