GDM allows local user to read any file
| Package(s): | GDM, XDMCP | CVE #(s): | CAN-2003-0547 CAN-2003-0548 CAN-2003-0549 | ||||||||||||||||
| Created: | August 21, 2003 | Updated: | August 29, 2003 | ||||||||||||||||
| Description: | GDM is the GNOME Display Manager for X.
Versions of GDM prior to 2.4.1.6 contain a bug where GDM will run as root when examining the ~/.xsession-errors file when using the "examine session errors" feature, allowing local users the ability to read any text file on the system by creating a symlink. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0547 to this issue. Additional problems may be found in the X Display Manager Control Protocol (XDMCP) which allow a denial of service attack (DoS) by crashing the gdm daemon. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2003-0548 and CAN-2003-0549 to these issues. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||