XFree86 Dexconf Dev/Dri Directory Insecure Permissions Vulnerability

Bugtraq ID:	8032
Class:	Configuration Error
CVE:	CVE-2001-1409
Remote:	No
Local:	Yes
Published:	Aug 28 2001 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery of this vulnerability has been credited to Brendan O'Dea <[email protected]>.
Vulnerable:	XFree86 X11R6 4.1 .0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 i386 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0 Sun Linux 5.0.6 Redhat XFree86-Xvfb-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-Xnest-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-xfs-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-xdm-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-xauth-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-twm-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-truetype-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-tools-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-Mesa-libGLU-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-Mesa-libGL-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-libs-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-9-75dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-9-100dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-2-75dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-2-100dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-15-75dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-ISO8859-15-100dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-font-utils-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-doc-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-devel-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-cyrillic-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-base-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-75dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386 Redhat XFree86-100dpi-fonts-4.2.0-72.i386.rpm + Redhat Linux 8.0 i386
Not Vulnerable:

XFree86 Dexconf Dev/Dri Directory Insecure Permissions Vulnerability

dexconf has been reported prone to an insecure directory permission vulnerability.

It has been reported that the dexconf utility sets the /dev/dri directory with world writeable permissions; this may provide a local attacker with a window of opportunity to alter or delete collected data from the affected directory. The attacker may also place arbitrary files in the directory.

XFree86 Dexconf Dev/Dri Directory Insecure Permissions Vulnerability

There is no exploit required.

XFree86 Dexconf Dev/Dri Directory Insecure Permissions Vulnerability

Solution:
Red Hat has released an advisory (RHSA-2003:064-01) to address this issue. Details on obtaining and applying fixes are contained in the referenced advisory.

Red Hat has released a revised advisory (RHSA-2003:067-02) to address this issue. Fixes from the previous advisory (RHSA-2003:067-01) are functional but contain debugging info. The revised advisory includes new fixes that do not contain debugging info. Details on obtaining and applying fixes are contained in the revised advisory.

Sun Linux updates are available.


Redhat XFree86-ISO8859-9-75dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-9-75dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-75dpi-fonts- 4.2.1-20.i386.rpm

Redhat XFree86-xdm-4.2.0-72.i386.rpm

• RedHat XFree86-xdm-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xdm-4.2.1-20.i386.rpm

Redhat XFree86-xfs-4.2.0-72.i386.rpm

• RedHat XFree86-xfs-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xfs-4.2.1-20.i386.rpm

Redhat XFree86-base-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-base-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-base-fonts-4.2.1-20.i3 86.rpm

Redhat XFree86-Xnest-4.2.0-72.i386.rpm

• RedHat XFree86-Xnest-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xnest-4.2.1-20.i386.rp m

Redhat XFree86-cyrillic-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-cyrillic-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-cyrillic-fonts-4.2.1-2 0.i386.rpm

Redhat XFree86-ISO8859-15-75dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-15-75dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-75dpi-fonts -4.2.1-20.i386.rpm

Redhat XFree86-libs-4.2.0-72.i386.rpm

• RedHat XFree86-libs-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-libs-4.2.1-20.i386.rpm

Redhat XFree86-tools-4.2.0-72.i386.rpm

• RedHat XFree86-tools-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-tools-4.2.1-20.i386.rp m

Redhat XFree86-devel-4.2.0-72.i386.rpm

• RedHat XFree86-devel-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-devel-4.2.1-20.i386.rp m

Redhat XFree86-Xvfb-4.2.0-72.i386.rpm

• RedHat XFree86-Xvfb-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xvfb-4.2.1-20.i386.rpm

Redhat XFree86-truetype-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-truetype-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-truetype-fonts-4.2.1-2 0.i386.rpm

Redhat XFree86-75dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-75dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-75dpi-fonts-4.2.1-20.i 386.rpm

Redhat XFree86-4.2.0-72.i386.rpm

• RedHat XFree86-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-4.2.1-20.i386.rpm

Redhat XFree86-ISO8859-9-100dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-9-100dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-100dpi-fonts -4.2.1-20.i386.rpm

Redhat XFree86-Mesa-libGLU-4.2.0-72.i386.rpm

• RedHat XFree86-Mesa-libGLU-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGLU-4.2.1-20.i 386.rpm

Redhat XFree86-100dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-100dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-100dpi-fonts-4.2.1-20. i386.rpm

Redhat XFree86-xauth-4.2.0-72.i386.rpm

• RedHat XFree86-xauth-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xauth-4.2.1-20.i386.rp m

Redhat XFree86-twm-4.2.0-72.i386.rpm

• RedHat XFree86-twm-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-twm-4.2.1-20.i386.rpm

Redhat XFree86-Mesa-libGL-4.2.0-72.i386.rpm

• RedHat XFree86-Mesa-libGL-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGL-4.2.1-20.i3 86.rpm

Redhat XFree86-ISO8859-2-100dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-2-100dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-100dpi-fonts -4.2.1-20.i386.rpm

Redhat XFree86-ISO8859-15-100dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-15-100dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-100dpi-font s-4.2.1-20.i386.rpm

Redhat XFree86-doc-4.2.0-72.i386.rpm

• RedHat XFree86-doc-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-doc-4.2.1-20.i386.rpm

Redhat XFree86-font-utils-4.2.0-72.i386.rpm

• RedHat XFree86-font-utils-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-font-utils-4.2.1-20.i3 86.rpm

Redhat XFree86-ISO8859-2-75dpi-fonts-4.2.0-72.i386.rpm

• RedHat XFree86-ISO8859-2-75dpi-fonts-4.2.1-20.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-75dpi-fonts- 4.2.1-20.i386.rpm

Sun Linux 5.0.6

• Sun XFree86-cyrillic-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-cyrillic-fonts-4.1.0-49.i386.rpm


• Sun XFree86-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-4.1.0-49.i386.rpm


• Sun XFree86-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-devel-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-devel-4.1.0-49.i386.rpm


• Sun XFree86-doc-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-doc-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-15-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-15-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-2-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-2-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-2-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-2-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-9-100dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-9-100dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-ISO8859-9-75dpi-fonts-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-ISO8859-9-75dpi-fonts-4.1.0-49.i386.rpm


• Sun XFree86-libs-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-libs-4.1.0-49.i386.rpm


• Sun XFree86-tools-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-tools-4.1.0-49.i386.rpm


• Sun XFree86-twm-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-twm-4.1.0-49.i386.rpm


• Sun XFree86-xdm-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xdm-4.1.0-49.i386.rpm


• Sun XFree86-xf86cfg-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xf86cfg-4.1.0-49.i386.rpm


• Sun XFree86-xfs-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-xfs-4.1.0-49.i386.rpm


• Sun XFree86-Xnest-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-Xnest-4.1.0-49.i386.rpm


• Sun XFree86-Xvfb-4.1.0-49.i386.rpm
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/XFree86-Xvfb-4.1.0-49.i386.rpm

XFree86 Dexconf Dev/Dri Directory Insecure Permissions Vulnerability

References:

• Bug#110475: [PATCH] Directory mode of /dev/dri is too open (Brendan O'Dea )
  
• RHSA-2003:064-01 Updated XFree86 4.1.0 packages are available (Red Hat)
  
• Sun Linux Support - Sun Linux Patches (Sun)