|
|
|
 |
Vulnerability Note VU#300368X.Org fails to check for setuid failure on Linux systemsOverviewPrograms distributed as part of the X.Org software distribution fail to properly handle test results for effective user ID. This vulnerability may lead to privilege escalation.I. DescriptionLinux, like most Unix systems, provides a system call, setuid(), to set the effective user ID of a process. A vulnerability exists in X.Org versions 6.7.0 through 7.1 on systems where setuid() may fail, even when invoked by a process running as root. In reference to systems using the Linux 2.6 kernel, X.Org Security Advisory, June 20th, 2006 states:This is because there is a 'maximum processes' ulimit, which is honoured by setuid(), seteuid(), and setgid(). These functions may fail because of this ulimit; if the return value is not checked, then code which is assumed to be running unprivileged, may in fact be running with uid 0. II. ImpactThis vulnerability may allow an authenticated attacker to run arbitrary code with elevated privileges.III. SolutionUpgrade or apply a patch from the vendorPatches have been released to address this issue. See the systems affected section of this document for information about specific vendors. Users who compile the X.Org software distribution from source are encouraged to update to the most recent version.
References
This issue was reported in X.Org Security Advisory, June 20th, 2006. X.Org credits Dirk Mueller and Marcus Meissner for reporting this issue. This document was written by Chris Taschner.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader