-----BEGIN PGP SIGNED MESSAGE-----

Subject: Caldera Security Advisory SA-1997.34: Vulnerabilities in XFree86 3.3

Original report date:  06-Aug-1997
RPM build date:    19-Dec-1997
Advisory issue date:  24-Dec-1997

Topic: Vulnerabilities in the XFree86 3.3 servers


I. Problem Descriptions

  (This security advisory covers three problems that are un-related
  except that they are both addressed in the same XFree86 update
  described in this advisory.)
  
  1) The X servers in the /usr/X11R6/bin directory can be used to
  read the first space delimited word of any file, regardless of
  access permissions.  The servers read the config files with root
  permissions, and if a user specifies an alternate file with the
  '-config' option, the first word of this file is displayed as
  part of an error message.

  2) The /tmp/.X11-unix directory is world writable.  Therefore,
  users can rename the X0 UNIX domain socket and replace it with
  a invalid one.

  3) XFree86, as any X-server, uses TCP ports 6000 and above
  to listen to, waiting for incoming connections. Any user can
  choose their display number simply by starting "X :any_display".
  The X server automatically chooses its port by adding the display
  number to 6000. But as the ports are 16-bits coded, port 65536
  equals 0, so displays 59536 to 65535 generate listening sockets
  on ports 0 to 5999.  And as the X-server runs SUID root, any user
  can use it to block known ports before a daemon starts using it.


II. Impacts

  1) An unprivileged user can view the first space delimited
  word of any file on the system.  For example, the first line of
  /etc/shadow, which an unprivileged user should not be able to
  view, often contains the encrypted root password.  A work-around
  for this problem is to move a less privileged user's /etc/shadow
  entry to the first line.

  2) An unprivileged user can break X, or they can modify the X0 Unix
  domain socket in such a way as to snoop on an X application's
  protocol exchange with the server.  In particular, key strokes
  can be intercepted, allowing the user to read everything that is
  typed including sensitive data.

  3) Because the X-server runs SUID root, any user can use it to block
  known ports before a daemon starts using it.

  To determine if you are vulnerable, type:

    rpm -qa | grep XFree86-

  If the server(s) shown is a version earlier than 3.3.1-3, you
  need to upgrade.


III. Solution
  
  Upgrade to the XFree86-[server]-3.3.1-3 packages.

  They can be found on Caldera's ftp site at:

    ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/RPMS/

  The corresponding source code can be found at:

    ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/SRPMS/

  The MD5 checksums (from the "md5sum" command) for these
  packages are:
  
  07710ecc693c519343f77fe61c542ba5  XFree86-8514-3.3.1-3.i386.rpm
  e30b1b9d5b549b9ee85b9ac3f9810ed7  XFree86-AGX-3.3.1-3.i386.rpm
  05da649d3f0c6e70db41c4ac596403e6  XFree86-I128-3.3.1-3.i386.rpm
  5d3b630acb6f3d78954decbc1b183ecb  XFree86-Mach32-3.3.1-3.i386.rpm
  e2255ccd3b23d2884f3da2ca543b885e  XFree86-Mach64-3.3.1-3.i386.rpm
  5cc6bbe46dc7836e6be0879cbc347f5f  XFree86-Mach8-3.3.1-3.i386.rpm
  91e3d6962683889c2acd351a345fd719  XFree86-Mono-3.3.1-3.i386.rpm
  5e77fe20f39994ea3872f008e42e5517  XFree86-P9000-3.3.1-3.i386.rpm
  b6319402b02efbf257a9451602c8ba84  XFree86-S3-3.3.1-3.i386.rpm
  bc6aee85e80db61d3f7edb183cd90f77  XFree86-S3V-3.3.1-3.i386.rpm
  29f8f9b26c6a3590715856645bb24b48  XFree86-SVGA-3.3.1-3.i386.rpm
  14e539c4bbb659fc7e7f35d499bc3401  XFree86-VGA16-3.3.1-3.i386.rpm
  3257dd1ca46312ebb81409b949516d1d  XFree86-W32-3.3.1-3.i386.rpm
  4f52c74a7f959ad4c7741fe9c77ffe52  XFree86-Xnest-3.3.1-3.i386.rpm
  230c41b27ed7347bf82c35ebfbb74c67  XFree86-Xprt-3.3.1-3.i386.rpm
  5fee0ebf4cebb04022e6a0825b7285e1  XFree86-Xvfb-3.3.1-3.i386.rpm
  92f8642b31e2df1e8a7a9da067fb0cf3  XFree86-server-3.3.1-3.i386.rpm
  9f0777319b7bfd47ea9944cfe0aff2c6  XFree86-setup-3.3.1-3.i386.rpm

  625405e598ccddc6def48e1fc1e81629  XFree86-server-3.3.1-3.src.rpm
  
  To upgrade, it is assumed that you have already upgraded to the
  XFree86-[server]-3.3.1-2 packages as discussed in Caldera
  Security Advisory SA-1997.15 - (September 9, 1997 Vulnerability
  in XFree86 3.2)
  
  Because of item #1 in Description and Impact discussed above,
  you will need to upgrade _all_ of the X servers installed on your
  system, not just the server currently in use.  To determine
  which servers are present, type "ls /usr/X11R6/bin/XF86_*".
  This should list the binary files for all of the X servers
  installed on your system in the form XF86_[server], where [server]
  is any of all of: { 8514, AGX, I128, Mach32, Mach64, Mach8, Mono,
  P9000, S3, S3V, SVGA, VGA16, W32 }.

  1. Upgrade all of the X servers in the following manner:

    rpm -U XFree86-[server]-3.3.1-3.i386.rpm

  Repeat the command above for all servers found with the

    "ls /usr/X11R6/bin/XF86_*" command.

  2. Upgrade the following packages:

    rpm -U XFree86-Xnest-3.3.1-3.i386.rpm
    rpm -U XFree86-Xprt-3.3.1-3.i386.rpm
    rpm -U XFree86-Xvfb-3.3.1-3.i386.rpm
    rpm -U XFree86-server-3.3.1-3.i386.rpm
    rpm -U XFree86-setup-3.3.1-3.i386.rpm


IV. References / Credits

  From:    dube0866@eurobretagne.fr (Nicolas Dubee)
  To:    XFree86@XFree86.Org
  Subject:  [XFree86(TM) Bug Report] Security hole in XFree servers
  Date:    Sun, 7 Sep 1997 19:48:11 -0400 (EDT)
  Message-Id:  199709072348.TAA29123@public.XFree86.Org

  From:    (shegget) root@SHEGG.RH1.IIT.EDU
  To:    BUGTRAQ@NETSPACE.ORG
  Subject:  XFree86 insecurity
  Date:    Fri, 21 Nov 1997 18:35:36 +0000
  Message-ID:  Pine.LNX.3.96.971121183345.723A-100000@shegg.rh1.iit.edu

  From:    (Willy TARREAU) tarreau@AEMIAIF.LIP6.FR
  To:    BUGTRAQ@NETSPACE.ORG
  Subject:  XFREE86 can block reserved ports
  Date:    Wed, 6 Aug 1997 10:14:30 +0200
  Message-ID:  199708060814.KAA00775@aemiaif.lip6.fr

  From:    (Carlo Wood) carlo@RUNAWAY.XS4ALL.NL
  To:    BUGTRAQ@NETSPACE.ORG
  Subject:  X Security problem (?)
  Date:    Fri, 14 Nov 1997 02:13:22 +0100
  Message-ID:  199711140113.CAA09289@jolan.xs4all.nl

  From:    (CERT(sm) Coordination Center) cert@cert.org
  To:    (Caldera Security) security@caldera.com
  Subject:  XF86 servers security hole (VU#16699) (caldera)
  Date:    Fri, 10 Oct 1997 12:03:22 -0400 (EDT)
  Message-Id:  199710101603.MAA14448@yobbo.cert.org

  This security fix closes Caldera's internal Problem Reports 823, 885,
  1008, 1104, 1274.

  This and other Caldera security resources are located at:

    http://www.caldera.com/tech-ref/security/


V. PGP Signature

  This message was signed with the PGP key for security@caldera.com.

  This key can be obtained from:
    ftp://ftp.caldera.com/pub/pgp-keys/

  Or on an OpenLinux CDROM under:
    /OpenLinux/pgp-keys/

  $Id: SA-1997.34,v 1.2 1997/12/24 19:13:19 ron Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNKFe8en+9R4958LpAQEpCAP/bW0/HWMpB+eFTO24sQwcEwnVSrBMPOu2
/zUanIXPjcWhCMS72mXK8aGjm2ZMr9SVUDwRNu61f7OByhH0viAN5pvqg0aHrHGK
WeGx6wlXgG/URcqx+h+Dh6Ifnd7DzibbEBhFCIuW8InmCRoplc69iBiZEAFMrpJc
uGsVax7IZhw=
=dO/g
-----END PGP SIGNATURE-----