X.Org X11 File Enumeration Information Disclosure Vulnerability

Bugtraq ID:	50193
Class:	Input Validation Error
CVE:	CVE-2011-4028
Remote:	No
Local:	Yes
Published:	Oct 18 2011 12:00AM
Updated:	Jul 15 2015 12:16AM
Credit:	Vladz
Vulnerable:	Xerox FreeFlow Print Server (FFPS) 73.C0.41 Xerox FreeFlow Print Server (FFPS) 73.B3.61 X.org xorg-server 1.4.1 X.org xorg-server 1.1.1 X.org xorg-server 1.4 X.org xorg-server 1.3.99.2 (RC2) X.org xorg-server 1.2 X.org xorg-server 1.02-r5 X.org xorg-server 1.0.2-r6 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server for VMware 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel 2.6.5 SuSE openSUSE 11.3 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 1.1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0
Not Vulnerable:	Avaya Aura System Manager 6.2 Avaya Aura Session Manager 6.0

X.Org X11 File Enumeration Information Disclosure Vulnerability

X.Org X11 is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

A local attacker can exploit this issue to enumerate the existence of local files. Information obtained may aid in further attacks.

X.Org X11 File Enumeration Information Disclosure Vulnerability

Attackers require local interactive access to exploit.

X.Org X11 File Enumeration Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

X.Org X11 File Enumeration Information Disclosure Vulnerability

References:

• (CVE-2011-4028) CVE-2011-4028 xorg-x11, xorg-x11-server: File existence disclosu (Red Hat)
  
• X.Org Homepage (X.Org)
  
• X.Org security advisory: xserver locking code issues (Matthieu Herrb)