[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080304223410.GB20956@steve.org.uk>
Date: Tue, 4 Mar 2008 22:34:10 +0000
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: Re: request CVE id: insecure handling of DISPLAY in
rxvt
On Tue Mar 04, 2008 at 16:51:42 -0500, Steven M. Christey wrote:
> > "If the DISPLAY environment is not set, rxvt opens an xterm
> > on :0, which on some headless login-server means anyone can setup
> > an fake X server waiting for someone loggin in without X
> > forwarding to start rxvt by some mistake or by some program (thus
> > without even noticing) and getting full shell access to that other
> > account."
> >
> > This is Debian bug 469296[0].
>
> Use CVE-2008-1142
>
> I'm not going to pretend to understand this issue, plus Lubomir's bug
> comment raises the question of dependency on user error (though it's
> probably a relatively common error, I'd think). So, I'll fill in the CVE
> later once this has been fleshed out.
It seems like an issue which I'd almost be tempted to say isn't
a security one.
The idea is that if you typically connect to a host with display
forwarding you'll be used to running rxvt and having the resulting
application display locally.
However if you forget to enable display forwarding then run
RXVT it will connect to :1, rather than complain there is no
DISPLAY set and abort. That *could* allow a malicious local
server to steal keyboard, & etc.
However I have a hard time seeing this in practise. It would
mean that locally you couldn't trust root - since it would take
a local root user to setup the fake X11 server on :1..
This attack is like saying that if you forget to open your
eyes you might accidentally walk into the wrong house and
have people see what you're doing..
Steve
--
http://www.steve.org.uk/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
