PT-2000-1969 · Xfce · Xfce

Published 2000-12-11 · Updated 2018-05-03 · CVE-2000-1060

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XFCE version 3.5.1

Description The default configuration of XFCE bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program. This allows local users to sniff X Windows traffic and gain privileges.

Recommendations For XFCE version 3.5.1, consider removing or modifying the "xhost + localhost" command in the xinitrc program to prevent bypassing the Xauthority access control mechanism. As a temporary workaround, restrict access to the X Windows system to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2000-1060

Affected Products

Xfce

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-1060 · Security Note
• http://securityfocus.com/bid/1736 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2000-10/0022.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5305 · Note