XFree86 4.1.0 Missing authDir Unauthorized xdm Connection Vulnerability

Bugtraq ID:	3965
Class:	Origin Validation Error
CVE:	CVE-2002-1510
Remote:	Yes
Local:	No
Published:	Jan 19 2002 12:00AM
Updated:	Jul 11 2009 09:56AM
Credit:	Minimal information about this issue was disclosed on the XFree86 security page on January 19th, 2002. Credit for discovery was not given.
Vulnerable:	XFree86 X11R6 4.1 .0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 i386 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0 XFree86 X11R6 4.0.3 + Redhat Linux 7.1 XFree86 X11R6 4.0.1 + Redhat Linux 7.0 XFree86 X11R6 4.0 XFree86 X11R6 3.3.6 + Debian Linux 2.2 + Redhat Linux 6.2 XFree86 X11R6 3.3.5 - Redhat Linux 6.1 i386 XFree86 X11R6 3.3.4 XFree86 X11R6 3.3.3 XFree86 X11R6 3.3.2 + Mandriva Linux Mandrake 8.0 XFree86 X11R6 3.3 Sun Linux 5.0.6
Not Vulnerable:	XFree86 X11R6 4.2 .0 + Conectiva Linux Enterprise Edition 1.0 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Workstation 8.0

XFree86 4.1.0 Missing authDir Unauthorized xdm Connection Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

XFree86 4.1.0 Missing authDir Unauthorized xdm Connection Vulnerability

Solution:
XFree86 has released version 4.2.0 which addresses this issue.

Red Hat updates are available.

Sun Linux updates have been released to correct this issue.


XFree86 X11R6 3.3

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 3.3.2

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 3.3.3

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 3.3.4

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 3.3.5

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 4.0

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 4.0.1

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 4.0.3

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

XFree86 X11R6 4.1 .0

• XFree86 X11R6 4.2.0 installation script
  This is just the installation script. You must acquire the platform specific binary for this distribution from ftp://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ or http://ftp.xfree86.org/pub/XFree86/4.2.0/binaries/ . To determine which distribution you need to download, obtain the installation scr
  ftp://ftp.xfree86.org/pub/XFree86/4.2.0/Xinstall.sh

Sun Linux 5.0.6

• Sun XFree86-cyrillic-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-cyrillic-fonts-4.1.0-49.i386.rpm


• Sun XFree86-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-4.1.0-49.i386.rpm


• Sun XFree86-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-cyrillic-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-cyrillic-fonts-4.1.0-49.i386.rpm


• Sun XFree86-devel-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-devel-4.1.0-49.i386.rpm


• Sun XFree86-doc-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-doc-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-15-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-2-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-2-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-2-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-2-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-9-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-9-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-9-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-9-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-libs-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-libs-4.1.0-49.i386.rpm


• Sun XFree86-tools-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-tools-4.1.0-49.i386.rpm


• Sun XFree86-twm-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-twm-4.1.0-49.i386.rpm


• Sun XFree86-xdm-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xdm-4.1.0-49.i386.rpm


• Sun XFree86-xf86cfg-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xf86cfg-4.1.0-49.i386.rpm


• Sun XFree86-xfs-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xfs-4.1.0-49.i386.rpm


• Sun XFree86-Xnest-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-Xnest-4.1.0-49.i386.rpm


• Sun XFree86-Xvfb-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-Xvfb-4.1.0-49.i386.rpm

XFree86 4.1.0 Missing authDir Unauthorized xdm Connection Vulnerability

References:

• Installation Details for XFree86[tm] 4.2.0 (XFree86)
  
• RHSA-2003:064-01 Updated XFree86 4.1.0 packages are available (Red Hat)
  
• RHSA-2003:064-18 Updated XFree86 4.1.0 packages are available (Red Hat)
  
• RHSA-2003:065-13 Updated XFree86 4.1.0 packages are available (Red Hat)
  
• Sun Linux Support - Sun Linux Patches (Sun)
  
• XDM(1) manual page (XFree86)
  
• XFree86 Homepage (XFree86)
  
• XFree86 Security Issues (XFree86)