|
|
|
|
| |
Credit:
The information has been provided by Daniel Stone.
|
| |
Vulnerable Systems:
* xorg-server version 1.0.0, as shipped with X11R7.0
* xorg-server version X11R7.0rc
* xorg-server version X11R6.9.0
* xorg-server version X11R6.9.0rc
* xorg-server version X11R6.8.2
* xorg-server version X11R6.8.2rc
When parsing arguments, the server checks that only root can pass the option -modulepath, which determines the location to load many modules providing server functionality from, and -logfile, which determines the location of the logfile. Normally, these locations cannot be changed by unprivileged users.
This test was changed to test the effective UID as well as the real UID in X.Org. The test is defective in that it tested the address of the geteuid function, not the result of the function itself. As a result, given that the address of geteuid() is always non-zero, an unprivileged user can load modules from any location on the filesystem with root privileges, or overwrite critical system files with the server log.
Proof of Concept:
The proof of concpet can be found: http://metasploit.com/users/hdm/tools/xmodulepath.tgz
Vendor Status:
The vendor has issued a fix:
X11R7 tree: http://xorg.freedesktop.org/releases/X11R7.0/patches/
xorg-server 1.0.2 has been released with this and other code fixes: http://xorg.freedesktop.org/releases/individual/xserver/
Apply the patch below to the X.Org server as distributed with X11R6.9: http://xorg.freedesktop.org/releases/X11R6.9.0/patches/
CVE Information:
CVE-2006-0745
|
|
|
|
|
