Vulnerability Note VU#911505

pam_xauth may insecurely forward "X MIT-Magic-Cookies" to new sessions

Overview

A vulnerability exists in pam_xauth that may allow a local attacker to gain access to an administrator's X session.

I. Description

pam_xauth is used to forward xauth keys (or cookies) between users. From the pam_xauth man page:

Without pam_xauth, when xauth is enabled and a user uses the su command to assume superuser priviledges, that user is not able to run X commands as root without somehow giving root access to the xauth key used for the current X session. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down.

If a local attacker can cause the system administrator to su to the attacker's account, the attacker may be able to gain access to an administrator's X session. For further technical details, please see Andreas Beck's advisory.

II. Impact

A local attacker may be able to gain access to an administrator's X session.

III. Solution

Apply a patch from your vendor.

Systems Affected

Vendor	Status	Date Notified
3Com	Unknown	5-May-2003
Alcatel	Unknown	5-May-2003
Apple Computer Inc.	Not Vulnerable	7-May-2003
AT&T	Unknown	5-May-2003
Avaya	Unknown	5-May-2003
BSDI	Unknown	5-May-2003
Cisco Systems Inc.	Unknown	5-May-2003
Computer Associates	Unknown	5-May-2003
Conectiva	Unknown	5-May-2003
Cray Inc.	Unknown	5-May-2003
D-Link Systems	Unknown	5-May-2003
Data General	Unknown	5-May-2003
Debian	Not Vulnerable	5-May-2003
Engarde	Unknown	5-May-2003
Extreme Networks	Unknown	5-May-2003
F5 Networks	Unknown	5-May-2003
Foundry Networks Inc.	Not Vulnerable	7-May-2003
FreeBSD	Unknown	5-May-2003
Fujitsu	Not Vulnerable	17-Jun-2003
Hewlett-Packard Company	Unknown	5-May-2003
Hitachi	Not Vulnerable	7-May-2003
IBM	Not Vulnerable	7-May-2003
Ingrian Networks	Not Vulnerable	7-May-2003
Intel	Unknown	5-May-2003
Juniper Networks	Unknown	5-May-2003
Lachman	Unknown	5-May-2003
Lotus Software	Unknown	5-May-2003
Lucent Technologies	Unknown	5-May-2003
MandrakeSoft	Vulnerable	5-May-2003
Microsoft Corporation	Unknown	5-May-2003
MontaVista Software	Unknown	5-May-2003
Multi-Tech Systems Inc.	Unknown	5-May-2003
Multinet	Unknown	5-May-2003
NEC Corporation	Unknown	5-May-2003
NetBSD	Unknown	5-May-2003
NetScreen	Not Vulnerable	7-May-2003
Network Appliance	Unknown	5-May-2003
NeXT	Unknown	5-May-2003
Nokia	Unknown	5-May-2003
Nortel Networks	Unknown	5-May-2003
OpenBSD	Unknown	5-May-2003
Openwall GNU/*/Linux	Vulnerable	7-May-2003
Oracle Corporation	Unknown	5-May-2003
Red Hat Inc.	Vulnerable	7-May-2003
Redback Networks Inc.	Unknown	5-May-2003
Riverstone Networks	Unknown	5-May-2003
SCO	Unknown	5-May-2003
Sequent	Unknown	5-May-2003
SGI	Unknown	5-May-2003
Sony Corporation	Unknown	5-May-2003
Sun Microsystems Inc.	Unknown	5-May-2003
SuSE Inc.	Unknown	5-May-2003
Unisys	Unknown	5-May-2003
Wind River Systems Inc.	Unknown	5-May-2003
Wirex	Unknown	5-May-2003
Xerox Corporation	Not Vulnerable	30-May-2003
ZyXEL	Unknown	5-May-2003

References

http://marc.theaimsgroup.com/?l=bugtraq&m=104431622818954&w=2
http://www.securityfocus.com/bid/6753
http://www.rt.com/man/pam_xauth.8.html

Credit

This vulnerability was discovered by Andreas Beck.

This document was written by Ian A Finlay.

Other Information

Date Public:	2003-02-03
Date First Published:	2003-05-04
Date Last Updated:	2003-06-17
CERT Advisory:
CVE-ID(s):	CAN-2002-1160
NVD-ID(s):	CAN-2002-1160
US-CERT Technical Alerts:
Metric:	12.94
Document Revision:	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader