oss-security - Re: cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20110803220257.16c8a84205602adcc08fada4@gmail.com>
Date: Wed, 3 Aug 2011 22:02:57 -0400
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com, coley@...-smtp.mitre.org
Subject: Re: cve id request: insecure xauth cookie handling in fglrx (ati
 catalyst) driver

Michael Gilbert wrote:

> Hi,
> 
> This may be an odd request.  The proprietary fglrx driver has an
> info disclosure flaw in one of it's shell scripts [0].  It passes the
> xauth secret cookie in an insecure manner (such that it's exposed to
> prying eyes in the output of ps for example).

Ping, can we get an id for this one?

Thanks,
Mike

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.