CVE-2002-1510

CVE-2002-1510 affects XFree86/xdm: when authComplain is false, arbitrary attackers can connect to the X server if the xdm auth directory does not exist. The vulnerability is documented in multiple sources (e.g., Red Hat advisories RHSA-2003:064/065) and is acknowledged in CVE/NVD listings; the is...

GLSA-200407-05 : XFree86, X.org: XDM ignores requestPort setting

The remote host is affected by the vulnerability described in GLSA-200407-05 XFree86, X.org: XDM ignores requestPort setting XDM will open TCP sockets for its chooser, even if the DisplayManager.requestPort setting is set to 0. Remote clients can use this port to connect to XDM and request a logi...

CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions...

CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions...

Mandrake Linux Security Advisory : XFree86 (MDKSA-2003:118)

A vulnerability was discovered in the XDM display manager that ships with XFree86. XDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, XDM may grant local root access to any user with valid login credentials. It has...

[ GLSA 200407-05 ] XFree86, X.org: XDM ignores requestPort setting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200407-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

XFree XDM TCP port protection bypass

XDM will open TCP sockets for its chooser, even if the DisplayManager.requestPort setting is set to 0...

RHEL 2.1 : XFree86 (RHSA-2003:065)

Updated XFree86 packages that resolve various security issues and additionally provide a number of bug fixes and enhancements are now available for Red Hat Enterprise Linux 2.1. XFree86 is an implementation of the X Window System, which provides the graphical user interface, video drivers, etc. f...

RHEL 2.1 : XFree86 (RHSA-2003:289)

Updated XFree86 packages provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. XDM is the X display manager. Multiple integer overflows in the transfer and enumeration of font libraries ...

CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions...

CVE-2004-0419

CVE-2004-0419 concerns the XFree86/XDM issue where XDM opens a chooserFd TCP socket even when the parameter DisplayManager.requestPort is 0. Affected software is XFree86/XDM (notably in Red Hat Enterprise Linux 3 and Gentoo/Gentoo GLSA advisories), with Red Hat RHSA-2004:478 describing backported...

CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions...

XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0

When the IPv6 code was added to xdm a critical test to disable xdmcp was accidentally removed. This caused xdm to create the chooser socket regardless if DisplayManager.requestPort was disabled in xdm-config or not...

Important: Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes

Updated XFree86 packages for Red Hat Linux 7.3 and 8.0 provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers in Red Hat Linux. XDM is the X display manager. Multiple integer overflows in...

Weaknesses in MIT magic cookie and XDM X Windows authorization

Overview MIT magic cookie and XDM authorization contain vulnerabilities that could allow remote attackers to connect to X displays. Description Two widely used X Window System authorization schemes have weaknesses in their sample implementations. MIT-MAGIC-COOKIE-1 On some systems built without t...

Important: Red Hat Security Advisory: XFree86 security update

Updated XFree86 packages that resolve various security issues and additionally provide a number of bug fixes and enhancements are now available for Red Hat Enterprise Linux 2.1. XFree86 is an implementation of the X Window System, which provides the graphical user interface, video drivers, etc. f...

CVE-2002-1510

xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist...

CVE-2001-1086

The CVE-2001-1086 issue affects XFree86 versions 3.3 and 3.3.3 where XDM cookies created via gettimeofday() with HasXdmXauth are easily guessable, allowing remote attackers to access the X display by brute forcing cookies. Supported by the provided records: partial confidentiality, integrity, and...

CVE-2001-1086

XDM in XFree86 3.3 and 3.3.3 generates easily guessable cookies using gettimeofday when compiled with the HasXdmXauth option, which allows remote attackers to gain unauthorized access to the X display via a brute force attack...