Bug 1284460 (CVE-2015-8308) - CVE-2015-8308 lxdm: X server started without -auth, exposing it to connections form any local user
Summary: CVE-2015-8308 lxdm: X server started without -auth, exposing it to connection...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-8308
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1268900
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-11-23 12:07 UTC by Martin Prpič
Modified: 2019-09-29 13:40 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-23 12:22:02 UTC
Embargoed:

Attachments (Terms of Use)

Description Martin Prpič 2015-11-23 12:07:08 UTC 
LXDM before 0.5.2 did not start X server with -auth parameter.
Therefore any user able to connect to it (typically all local users)
would have their X connections accepted.  The issue was fixed via:

http://git.lxde.org/gitweb/?p=lxde/lxdm.git;a=commitdiff;h=e8f387089e241360bdc6955d3e479450722dcea3

Additional information is available in bug 1268900.
Comment 1 Tomas Hoger 2015-11-23 12:22:02 UTC 
This was already fixed in all Fedora versions via bug 1268900.
Note You need to log in before you can comment on or make changes to this bug.