[ GLSA 200608-25 ] X.org and some X.org libraries: Local privilege escalations

[GLSA]

Gentoo Linux Security Advisory

Title: X.org and some X.org libraries: Local privilege escalations (GLSA 200608-25)
Severity: high
Exploitable: local
Date: August 28, 2006
Updated: December 13, 2006
Bug(s): #135974
ID: 200608-25

Synopsis

X.org, libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm are vulnerable to local privilege escalations because of unchecked setuid() calls.

Background

X.org is an implementation of the X Window System.

Affected Packages

Package: x11-apps/xdm
Vulnerable: < 1.0.4-r1
Unaffected: >= 1.0.4-r1
Architectures: All supported architectures

Package: x11-apps/xinit
Vulnerable: < 1.0.2-r6
Unaffected: >= 1.0.2-r6
Architectures: All supported architectures

Package: x11-apps/xload
Vulnerable: < 1.0.1-r1
Unaffected: >= 1.0.1-r1
Architectures: All supported architectures

Package: x11-apps/xf86dga
Vulnerable: < 1.0.1-r1
Unaffected: >= 1.0.1-r1
Architectures: All supported architectures

Package: x11-base/xorg-x11
Vulnerable: < 6.9.0-r2
Unaffected: >= 6.8.2-r8 < 6.8.3
Unaffected: >= 6.9.0-r2
Architectures: All supported architectures

Package: x11-base/xorg-server
Vulnerable: < 1.1.0-r1
Unaffected: >= 1.0.2-r6 < 1.0.3
Unaffected: >= 1.1.0-r1
Architectures: All supported architectures

Package: x11-libs/libx11
Vulnerable: < 1.0.1-r1
Unaffected: >= 1.0.1-r1
Architectures: All supported architectures

Package: x11-libs/xtrans
Vulnerable: < 1.0.0-r1
Unaffected: >= 1.0.0-r1
Architectures: All supported architectures

Package: x11-terms/xterm
Vulnerable: < 215
Unaffected: >= 215
Architectures: All supported architectures

Package: app-emulation/emul-linux-x86-xlibs
Vulnerable: < 7.0-r2
Unaffected: >= 7.0-r2
Architectures: amd64


Description

Several X.org libraries and X.org itself contain system calls to set*uid() functions, without checking their result.

Impact

Local users could deliberately exceed their assigned resource limits and elevate their privileges after an unsuccessful set*uid() system call. This requires resource limits to be enabled on the machine.

Workaround

There is no known workaround at this time.

Resolution

All X.Org xdm users should upgrade to the latest version: