[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080305092432.GA10542@steve.org.uk>
Date: Wed, 5 Mar 2008 09:24:32 +0000
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: Re: request CVE id: insecure handling of DISPLAY in
rxvt
On Wed Mar 05, 2008 at 10:19:09 +0100, Tomas Hoger wrote:
> Yes, many assumptions and ifs, but still silently assuming DISPLAY=:0
> when no DISPLAY is set does not sound like a safe default.
Agreed.
> But then I also don't understant what you mean by "setup an fake X
> server waiting for someone loggin in..."
This should be a matter of running 'startx' appropriately. I was
under the misapprehension that only root could startup X, but that
seems not to be the case.
Providing the host wasn't already running X then it might be possible
for local users to launch a copy they control.
> Could you describe the attack scenario in a bit more details?
I'd look forward to that too.
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
