A NULL pointer dereference, leading to denial of service flaw was found in the way X.Org X11 xdm, X.Org X Display Manager, performed user credentials verification, when the FIPS-140 mode was enabled on the underlying Linux system or the xdm was compiled against glibc library of version of 2.17 and above. A local attacker could provide a specially-crafted input that, when processed would lead to xdm executable crash. References: [1] http://www.openwall.com/lists/oss-security/2013/06/11/5 Relevant upstream patch: [2] http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117
Created xorg-x11-xdm tracking bugs for this issue Affects: fedora-all [bug 973698]
This issue only affects those builds of xdm which use raw crypt() authentication, instead of a higher level system such as PAM or BSD Auth. The version of xdm binary as shipped in xorg-x11-xdm package, in Red Hat Enterprise Linux 5 and 6 is linked against PAM libraries and is therefore not affected by this flaw.
Statement: Not Vulnerable. This issue does not affect the version of xorg-x11-xdm as shipped with Red Hat Enterprise Linux 5 and 6.
This issue does not affect the version of xorg-x11-xdm package as shipped with Fedora 17 and Fedora 18.