Bug 1007186 - (CVE-2013-4331) CVE-2013-4331 lightdm: Word-readable .Xauthority
CVE-2013-4331 lightdm: Word-readable .Xauthority
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20130904,reported=2...
: Security
Depends On: 1007187
Blocks: 1007189
  Show dependency treegraph
 
Reported: 2013-09-12 01:21 EDT by Ratul Gupta
Modified: 2015-08-22 11:27 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-22 11:27:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ratul Gupta 2013-09-12 01:21:33 EDT
It was found that lightdm prior to versions 1.4.3 and 1.6.2 created .Xauthority files in a user's home directory with world-readable permissions.  If a local user was able to access this file of another user, they could obtain the magic cookie it contained and connect to the X server as that user.  This would only be possible if the user's home directory did not have appropriate secure permissions (such as 0700).

Links to fixing commits:

1.4.x:
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1571
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1576
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1577

1.6.x:
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1641
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1652
http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1653

Bug Reports:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721744
Comment 1 Ratul Gupta 2013-09-12 01:26:54 EDT
Created lightdm tracking bugs for this issue:

Affects: fedora-all [bug 1007187]
Comment 2 Ratul Gupta 2013-09-12 02:06:18 EDT
This was assigned CVE-2013-4331: http://www.openwall.com/lists/oss-security/2013/09/11/8

Note You need to log in before you can comment on or make changes to this bug.