Red Hat Bugzilla – Bug 973695
CVE-2013-2179 xorg-x11-xdm: NULL pointer dereference (DoS) when verifying user credentials in FIPS-140 mode or using glibc >= 2.17
Last modified: 2016-03-04 07:31:13 EST
A NULL pointer dereference, leading to denial of service flaw was found in the way X.Org X11 xdm, X.Org X Display Manager, performed user credentials verification, when the FIPS-140 mode was enabled on the underlying Linux system or the xdm was compiled against glibc library of version of 2.17 and above. A local attacker could provide a specially-crafted input that, when processed would lead to xdm executable crash.
Relevant upstream patch:
Created xorg-x11-xdm tracking bugs for this issue
Affects: fedora-all [bug 973698]
This issue only affects those builds of xdm which use raw crypt() authentication, instead of a higher level system such as PAM or BSD Auth. The version of xdm binary as shipped in xorg-x11-xdm package, in Red Hat Enterprise Linux 5 and 6 is linked against PAM libraries and is therefore not affected by this flaw.
Not Vulnerable. This issue does not affect the version of xorg-x11-xdm as shipped with Red Hat Enterprise Linux 5 and 6.
This issue does not affect the version of xorg-x11-xdm package as shipped with Fedora 17 and Fedora 18.