XLock, a program that enables users to lock their UNIX machine while they are staying in an XWindows environment, might have a possible buffer overflow in it's code.
XLock when it is executed looks for '.xlocktext', '.plan' and '.signature' in the user's home directory and when it finds any of them, it will open them for reading. If a malicious user would replace any of the mentioned files with a file containing assembly code, he could possible cause the read text to overflow the buffer to which the file is read into, and cause a possible execution of an arbitrary code.
Even more, because xlock is most environments is set-uid root, there is the possibility that a malicious user might be able to gain root access.
The possible buffer overflow was found by: Aaron Campbell.
The author of XLock (xlockmore) has been notified.
