Vulnerability Note VU#704969

In X windows terminology, the X server is the software which provides "services" to the client, while the X client is the software that makes display requests to this server. This terminology is reversed from what many users would expect, with the X server running on the local computer, connecting to a multi-user Unix host (the X client).

For convenience, many X Windows emulators are configured to allow any remote X client to open windows on the X server. On command-line based systems the equivalent configuration is generated by executing "xhost +". This configuration is insecure because attackers may be able to connect to the X server and monitor keystrokes or inject commands into X windows sessions.

The interface for controlling which hosts may connect to the server varies from product to product, but many have a window for listing allowed hosts. Minimally, this list should contain only those hosts on which the user intends to use X windows. In command-line environments, the list is modified using the xhost command to add allowed hosts. This configuration may still leave the user open to attacks from other users of the listed hosts. For X windows security in multi-user environments, users should use the Xauthority facility.

In an insecure configuration, an attacker may sniff keystrokes or inject X windows events. Often this is sufficient to gain the privileges of the user running the insecure X server.

Use the Xauthority facility
X windows includes support for a security mechanism involving shared secrets between the X client and the X server. This mechanism usually involves storing the shared secret in a file named ".Xauthority" which needs to be accessible by both the client and server. In this configuration, the security of the X windows connection is equal to the file system security of the .Xauthority file. Xauthority secrets are, however, sent in plaintext, and may be sniffed by an attacker with access to the network.

SSH users may enable host security for 127.0.0.1

For users tunneling X windows traffic over SSH, the allowed hosts list may contain 127.0.0.1 if the user is the only person using the computer where the X server resides. Since traffic over the network is encrypted, an attacker may not sniff or alter X windows connections.