From this mail : http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html Two vulnerabilities have been discovered in the code handling the X server lock, that forbids two X servers from serving the same display simultaneously. o CVE-2011-4028 : File disclosure vulnerability: It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file. o CVE-2011-4029 : File permission change vulnerability: It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes. Fix - --- Those issues have been fixed by the following two git commits: CVE-2011-4028: 6ba44b91e37622ef8c146d8f2ac92d708a18ed34 http://cgit.freedesktop.org/xorg/xserver/commit/?id=6ba44b91e37622ef8c146d8f2ac92d708a18ed34 CVE-2011-4029: b67581cf825940fdf52bf2e0af4330e695d724a4 http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4
Ping ?
I've no time for this
Assignee: thierry.vignaud => security
i look this one
CC: (none) => dmorganec
pushed in updates_testing fixing the 2 CVE
Assignee: security_officers => qa-bugs
Created attachment 1325 [details] POC for CVE-2011-4029 There are instructions in the file, not tried it yet though.
POC does work as intended and shows we are vulnerable Testing x86_64 Before ------ $ ll /etc/shadow -r--r----- 1 root shadow 1174 Jan 3 11:14 /etc/shadow $ ./xchmod /etc/shadow [+] Trying to stop a Xorg process right before chmod() [+] Process ID 3877 stopped (SIGSTOP sent) [+] Removing /tmp/.tX1-lock by launching another Xorg process [+] Creating evil symlink (/tmp/.tX1-lock -> /etc/shadow) [+] Process ID 3877 resumed (SIGCONT sent) [+] Attack succeeded, ls -l /etc/shadow: -r--r--r-- 1 root shadow 1174 Jan 3 11:14 /etc/shadow $ ll /etc/shadow -r--r--r-- 1 root shadow 1174 Jan 3 11:14 /etc/shadow Undoing it.. $ su -c "chmod 440 /etc/shadow" - Password: $ ll /etc/shadow -r--r----- 1 root shadow 1174 Jan 3 11:14 /etc/shadow After ----- The following 3 packages are going to be installed: - x11-server-common-1.10.1-1.1.mga1.x86_64 - x11-server-devel-1.10.1-1.1.mga1.x86_64 - x11-server-xorg-1.10.1-1.1.mga1.x86_64 $ ll /etc/shadow -r--r----- 1 root shadow 1174 Jan 3 11:14 /etc/shadow $ ./xchmod /etc/shadow [+] Trying to stop a Xorg process right before chmod() [+] Process ID 5223 stopped (SIGSTOP sent) [+] Removing /tmp/.tX1-lock by launching another Xorg process [+] Creating evil symlink (/tmp/.tX1-lock -> /etc/shadow) [+] Process ID 5223 resumed (SIGCONT sent) [-] Attack failed, rights are 100440. Try again! $ ll /etc/shadow -r--r----- 1 root shadow 1174 Jan 3 11:14 /etc/shadow
Testing complete on i586. Could someone from the sysadmin team push the srpm x11-server-1.10.1-1.1.mga1.src.rpm from Core Updates Testing to Core Updates. Advisory: This security update for x11-server corrects the following two vulnerabilities have been discovered in the code handling the X server lock, that forbids two X servers from serving the same display simultaneously. o CVE-2011-4028 : File disclosure vulnerability: It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file. o CVE-2011-4029 : File permission change vulnerability: It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes. https://bugs.mageia.org/show_bug.cgi?id=3102
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugs
Update pushed.
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED