It was found that lightdm prior to versions 1.4.3 and 1.6.2 created .Xauthority files in a user's home directory with world-readable permissions. If a local user was able to access this file of another user, they could obtain the magic cookie it contained and connect to the X server as that user. This would only be possible if the user's home directory did not have appropriate secure permissions (such as 0700). Links to fixing commits: 1.4.x: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1571 http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1576 http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1577 1.6.x: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1641 http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1652 http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1653 Bug Reports: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721744
Created lightdm tracking bugs for this issue: Affects: fedora-all [bug 1007187]
This was assigned CVE-2013-4331: http://www.openwall.com/lists/oss-security/2013/09/11/8