PT-2006-5949 · Netbsd+2 · X Display Manager+2

Jeremy C. Reed · Published 2006-10-09 · Updated 2018-10-30 · CVE-2006-5214

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions X Display Manager (xdm) in NetBSD versions prior to 20060212 X.Org versions prior to 20060225 Solaris versions 8 through 10 prior to 20061006

Description A race condition in the Xsession script causes a user's Xsession errors file to have weak permissions before a chmod is performed. This allows local users to read Xsession errors files of other users.

Recommendations For NetBSD versions prior to 20060212, update to a version after 20060212 to resolve the issue. For X.Org versions prior to 20060225, update to a version after 20060225 to resolve the issue. For Solaris versions 8 through 10 prior to 20061006, update to a version after 20061006 to resolve the issue.

Fix

Related Identifiers

CVE-2006-5214

Affected Products

Solaris

X Display Manager

X.Org

References · 17

• http://netbsd.org/cgi-bin/query-pr-single.pl?number=32804 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5214 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5214 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-5214 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-5214 · Vendor Advisory
• http://ubuntu.com/usn/usn-364-1 · Vendor Advisory
• https://bugs.freedesktop.org/show_bug.cgi?id=5897 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm · Note
• http://secunia.com/advisories/22469 · Note
• http://secunia.com/advisories/22439 · Note
• http://securitytracker.com/id?1017015 · Note
• http://secunia.com/advisories/22992 · Note
• http://vupen.com/english/advisories/2006/3962 · Note
• http://secunia.com/advisories/22323 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1760 · Note