Bug 210311 - CVE-2006-5214 Xsession problems (CVE-2006-5215)
Summary: CVE-2006-5214 Xsession problems (CVE-2006-5215)
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: xinitrc
Version: 4.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: X/OpenGL Maintenance List
QA Contact: Jay Turner
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-10-11 14:29 UTC by Mark J. Cox
Modified: 2015-01-08 00:14 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-08-21 11:33:49 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Mark J. Cox 2006-10-11 14:29:41 UTC
Two issues in XFree86/xorg Xsession were reported and fixed upstream.  Both
relate to the handling of the xsession file.  

CVE-2006-5214: A local attacker could open for reading a users
~/.xsession-errors file if they are able to win a race during it's creation and
have sufficient privileges (+x) to the victims home directory already.

CVE-2006-5215: A local attacker could perform a temporary file attack on the
xsession error file created in /tmp and cause it to overwrite particular files
of the victim.  However this file is only created if the ability to create
~/.xsession-errors in the victims home directory fails, (something the attacker
has no control over).  The upstream Xsession code was different (and worse) than
our xinitrc code, but we should use mkstemp.

We've rated these issues as low severity and they can be deferred until a future
update for some other reason.

Affects: RHEL4, RHEL3, RHEL2.1

Comment 1 Mark J. Cox 2007-08-21 11:33:49 UTC
covered by bz#230007; should we fix this in rhel we'll create appropriate
tracking bugs with flags at that time.


Note You need to log in before you can comment on or make changes to this bug.