PT-2000-1968 · Mandrake · Mandrake Linux

Published 2000-12-11 · Updated 2017-10-10 · CVE-2000-1059

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mandrake Linux versions 7.0 through 7.1

Description The default configuration of the Xsession file bypasses the Xauthority access control mechanism with an "xhost + localhost" command. This allows local users to sniff X Windows events and gain privileges.

Recommendations For Mandrake Linux versions 7.0 through 7.1, consider modifying the Xsession file to remove the "xhost + localhost" command to prevent bypassing the Xauthority access control mechanism. As a temporary workaround, restrict access to the X Windows system to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2000-1059

Affected Products

Mandrake Linux

References · 5

• http://securityfocus.com/bid/1735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-1059 · Security Note
• http://linux-mandrake.com/en/security/MDKSA-2000-052.php3 · Note
• http://securityfocus.com/archive/1/136495 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5305 · Note