Vulnerability Note VU#704969

X servers may have insecure default configuration of xhosts

For convenience, many X Windows emulators are configured to allow any remote X client to open windows on the X server. On command-line based systems the equivalent configuration is generated by executing "xhost +". This configuration is insecure because attackers may be able to connect to the X server and monitor keystrokes or inject commands into X windows sessions.

The interface for controlling which hosts may connect to the server varies from product to product, but many have a window for listing allowed hosts. Minimally, this list should contain only those hosts on which the user intends to use X windows. In command-line environments, the list is modified using the xhost command to add allowed hosts. This configuration may still leave the user open to attacks from other users of the listed hosts. For X windows security in multi-user environments, users should use the Xauthority facility.

II. Impact

X windows includes support for a security mechanism involving shared secrets between the X client and the X server. This mechanism usually involves storing the shared secret in a file named ".Xauthority" which needs to be accessible by both the client and server. In this configuration, the security of the X windows connection is equal to the file system security of the .Xauthority file. Xauthority secrets are, however, sent in plaintext, and may be sniffed by an attacker with access to the network.

SSH users may enable host security for 127.0.0.1

For users tunneling X windows traffic over SSH, the allowed hosts list may contain 127.0.0.1 if the user is the only person using the computer where the X server resides. Since traffic over the network is encrypted, an attacker may not sniff or alter X windows connections.

Systems Affected

Credit

Thanks to Christopher Cuckow for reporting this vulnerability.

This document was written by Cory F Cohen.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.