PT-2000-1969 · Xfce · Xfce

Publicado 2000-12-11 · Atualizado 2018-05-03 · CVE-2000-1060

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XFCE version 3.5.1

Description The default configuration of XFCE bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program. This allows local users to sniff X Windows traffic and gain privileges.

Recommendations For XFCE version 3.5.1, consider removing or modifying the "xhost + localhost" command in the xinitrc program to prevent bypassing the Xauthority access control mechanism. As a temporary workaround, restrict access to the X Windows system to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2000-1060

Produtos afetados

Xfce

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-1060 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2000-10/0022.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5305 · Nota
• http://securityfocus.com/bid/1736 · Aviso do Fabricante