Bug 463927 - CVE-2007-5079 gdm with xdmcp ignoring tcp_wrappers on x86_64 [rhel-4.9]
Summary: CVE-2007-5079 gdm with xdmcp ignoring tcp_wrappers on x86_64 [rhel-4.9]
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: gdm
Version: 4.9
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Ray Strode [halfline]
QA Contact: desktop-bugs@redhat.com
URL:
Whiteboard: impact=low,source=bugzilla,reported=2...
Depends On:
Blocks: CVE-2007-5079 485811
TreeView+ depends on / blocked
 
Reported: 2008-09-25 14:30 UTC by Ray Strode [halfline]
Modified: 2012-03-28 15:35 UTC (History)
6 users (show)

Fixed In Version: gdm-2.6.0.5-7.rhel4.21
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-28 15:35:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Ray Strode [halfline] 2008-09-25 14:30:44 UTC
+++ This bug was initially created as a clone of Bug #181302 +++

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iOpus-I-M; SV1)

Description of problem:
The x86_64 bit version of AS4 (fully patched) appears to ignore tcp_wrappers completely when using gdm with XDMCP. The 32 bit version of AS4 works perfectly so this bug appears to be restricted to the 64bit version. I suspect the problem with the wrappers on the 64 bit version may be a bit more general than just XDMCP access as I tested a telnet server and while the wrappers are not completely ignored connections are not refused cleanly (You donât get the login prompt but you are still hooked up to the machine). The 32 bit version again works perfectly.

Version-Release number of selected component (if applicable):
tcp_wrappers

How reproducible:
Always

Steps to Reproduce:
1. Instll the OS
2. Configure gdmsetup to allow remote XDMCP conectivity
3. configure hosts.deny to restrict conections all:all
  

Actual Results:  no restriction to remote desktop

Expected Results:  remote desktop should have been refused

Additional info:

Comment 6 Tomas Hoger 2012-03-28 15:35:28 UTC
Red Hat Enterprise Linux 4 was reached end of Production Phase and transitioned to Extended Life Phase.  Component 'gdm' is excluded from the RHEL 4 ELS coverage and therefore this bug is no longer needed.

Extended Life Cycle Support - Exclusions:
http://www.redhat.com/rhel/server/extended_lifecycle_support/exclusions/


Note You need to log in before you can comment on or make changes to this bug.