Vulnerability Note VU#704969

X servers may have insecure default configuration of xhosts

Original Release date: 18 Jul 2003 | Last revised: 23 Feb 2004

Overview

Some X server products (client software for connecting to a host with Xwindows capabilities) may be configured insecurely by default.

Description

In X windows terminology, the X server is the software which provides "services" to the client, while the X client is the software that makes display requests to this server. This terminology is reversed from what many users would expect, with the X server running on the local computer, connecting to a multi-user Unix host (the X client).

For convenience, many X Windows emulators are configured to allow any remote X client to open windows on the X server. On command-line based systems the equivalent configuration is generated by executing "xhost +". This configuration is insecure because attackers may be able to connect to the X server and monitor keystrokes or inject commands into X windows sessions.

The interface for controlling which hosts may connect to the server varies from product to product, but many have a window for listing allowed hosts. Minimally, this list should contain only those hosts on which the user intends to use X windows. In command-line environments, the list is modified using the xhost command to add allowed hosts. This configuration may still leave the user open to attacks from other users of the listed hosts. For X windows security in multi-user environments, users should use the Xauthority facility.

Impact

In an insecure configuration, an attacker may sniff keystrokes or inject X windows events. Often this is sufficient to gain the privileges of the user running the insecure X server.

Solution

Use the Xauthority facility
X windows includes support for a security mechanism involving shared secrets between the X client and the X server. This mechanism usually involves storing the shared secret in a file named ".Xauthority" which needs to be accessible by both the client and server. In this configuration, the security of the X windows connection is equal to the file system security of the .Xauthority file. Xauthority secrets are, however, sent in plaintext, and may be sniffed by an attacker with access to the network.


SSH users may enable host security for 127.0.0.1

For users tunneling X windows traffic over SSH, the allowed hosts list may contain 127.0.0.1 if the user is the only person using the computer where the X server resides. Since traffic over the network is encrypted, an attacker may not sniff or alter X windows connections.

Systems Affected (Learn More)

No information available. If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

  • None

Credit

Thanks to Christopher Cuckow for reporting this vulnerability.

This document was written by Cory F Cohen.

Other Information

  • CVE IDs: Unknown
  • Date Public: 18 Jul 2003
  • Date First Published: 18 Jul 2003
  • Date Last Updated: 23 Feb 2004
  • Severity Metric: 11.25
  • Document Revision: 14

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.