CVE-2002-1160

The default configuration of the pamxauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su...

Mandrake Linux Security Advisory : pam (MDKSA-2003:017-1)

Andreas Beck discovered that the pamxauth module would forward authorization information from the root account to unprivileged users. This can be exploited by a local attacker to gain access to the root user's X session. In order for it to be successfully exploited, the attacker would have to...

RHEL 2.1 : pam (RHSA-2003:028)

Updated PAM packages are now available. These packages correct a bug in pamxauth's handling of authorization data for the root user. Updated 12 March 2003 Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS The pamxauth module is used to forward xauth information from...

pam_xauth may insecurely forward "X MIT-Magic-Cookies" to new sessions

Overview A vulnerability exists in pamxauth that may allow a local attacker to gain access to an administrator's X session. Description pamxauth is used to forward xauth keys or cookies between users. From the pamxauth man page:Without pamxauth, when xauth is enabled and a user uses the su comman...

Important: Red Hat Security Advisory: pam security update

Updated PAM packages are now available. These packages correct a bug in pamxauth's handling of authorization data for the root user. Updated 12 March 2003 Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS The pamxauth module is used to forward xauth information from...

CVE-2002-1160

The default configuration of the pamxauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su...

Important: Red Hat Security Advisory: : : : Updated PAM packages fix bug in pam_xauth module

Updated PAM packages are now available for Red Hat Linux 7.1, 7.2, 7.3, and 8.0. These packages correct a bug in pamxauth's handling of authorization data for the root user. Updated 16 April 2003 Added packages for Red Hat Linux on IBM iSeries and pSeries systems. The pamxauth module is used to...