Turbo Linux xhost Vulnerability

Bugtraq ID:	91
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	Unknown
Published:	May 01 1998 12:00AM
Updated:	May 01 1998 12:00AM
Credit:	This vulnerability was published on the BugTraq mailing list by Jeremy Brand <[email protected]> on Fri, 1 May 1998.
Vulnerable:	Pacific HiTech TurboLinux 1.2 Pacific HiTech TurboLinux 1.0
Not Vulnerable:

Turbo Linux xhost Vulnerability

The default xinitrc and .xinitrc files on TurboLinux 1.0 and 1.2
system allows unstricted access to the X server. From the
TurboLinux 1.2 /etc/X11/xinit/xinitrc file:

#START_STARTUP_APPS
xhost +
#END_STARTUP_APPS

Turbo Linux xhost Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Turbo Linux xhost Vulnerability

Solution:
Comment out the offending line from the xinitrc file or
update the xinitrc package to xinitrc-2.0-3TL.i386.rpm or later.

Comment out the offending line from all users .xinitrc file and
update the etcskel package to etcskel-2.0-1TL.i386.rpm or later.

You can download the update from
ftp://ftp.turbolinux.com/pub/tl_updates/