OP XAUTHORITY变量本地特权提升漏洞

BUGTRAQ ID: 30226 CNCAN ID：CNCAN-2008071606 OP是一款类似sudo的可替代程序。 OP处理XAUTHORITY变量存在缓冲区溢出，本地攻击者可以利用漏洞提升特权。 当OP使用--enable-xauth配置，并在op.conf中使用xauth配置选项，提交超长数据作为XAUTHORITY变量数据,可触发缓冲区溢出，以高权限执行任意代码，提升特权。 op 1.32 可参考如下安全补丁： http://swapoff.org/changeset/563...

pam security, bug fix, and enhancement update

0.77-66.23 - pamcracklib should count the last char when computing difference 267201 0.77-66.22 - add pamtally2 module 228044 - unset XAUTHORITY when appropriate 228980 - CVE-2007-1716 always decrement use count 230823 - reset priority only when specified in limits.conf 232407 - CVE-2007-3102...

CVE-2004-0390

SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods...

CVE-2004-0390

SCO OpenServer 5.0.5–5.0.7 exposes an authentication gap: it supports Xauthority style access control only when logging in via scologin, which can allow an unauthorized user to gain access to an X session through other X login methods. The vulnerability is described in CVE-2004-0390 and has a hig...

CVE-2004-0390: Undefined Security Weakness

SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods...

CVE-2005-0579

nxagent in FreeNX before 0.2.8 does not properly handle when the XAUTHORITY environment variable is not set, which allows local users to access the X server without X authentication...

CVE-2005-0579: Undefined Security Weakness

nxagent in FreeNX before 0.2.8 does not properly handle when the XAUTHORITY environment variable is not set, which allows local users to access the X server without X authentication...

CVE-2004-0390

SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods...

X servers may have insecure default configuration of xhosts

Overview Some X server products client software for connecting to a host with Xwindows capabilities may be configured insecurely by default. Description In X windows terminology, the X server is the software which provides "services" to the client, while the X client is the software that makes...

CVE-1999-1239

HP-UX 9.x does not properly enable the Xauthority mechanism in certain conditions, which could allow local users to access the X display even when they have not explicitly been authorized to do so...

CVE-1999-1239: Undefined Security Weakness

HP-UX 9.x does not properly enable the Xauthority mechanism in certain conditions, which could allow local users to access the X display even when they have not explicitly been authorized to do so...

CVE-2000-1060

The CVE-2000-1060 entry describes a vulnerability in XFCE 3.5.1 where the default xinitrc configuration runs xhost + localhost, bypassing Xauthority access control. This local-privilege issue allows nearby users to sniff X11 traffic and potentially escalate privileges. The root cause is the insec...

CVE-2000-1059

The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges...

CVE-2000-1059

The CVE-2000-1059 issue affects Mandrake Linux 7.0 and 7.1, where the default /etc/X11/Xsession configuration disables Xauthority via an "xhost + localhost" setting. This allows local users to connect to an X server on the localhost, potentially sniffing X Windows events and escalating privileges...

CVE-2000-1059: Undefined Security Weakness

The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges...

CVE-2000-1060: Undefined Security Weakness

The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffic and gain privileges...

CVE-2000-1060

The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffic and gain privileges...

CVE-2000-1059

The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges...

CVE-1999-1239

HP-UX 9.x does not properly enable the Xauthority mechanism in certain conditions, which could allow local users to access the X display even when they have not explicitly been authorized to do so...