PT-2013-3580 · X.Org+2 · X.Org Xdm+2
David Walser
·
Published
2013-12-27
·
Updated
2024-06-15
·
CVE-2013-2179
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
X.Org xdm versions 1.1.10 through 1.1.11
Description
The issue allows remote attackers to cause a denial of service by attempting to log into an account with a password field containing invalid characters, resulting in a NULL pointer dereference and crash. This can be demonstrated using the crypt function from glibc 2.17 and later with specific characters in the salt portion of a password field or passwords encrypted using DES or MD5 in FIPS-140 mode.
Recommendations
For X.Org xdm versions 1.1.10 and 1.1.11, consider restricting access to accounts with potentially invalid password fields until a patch is available. As a temporary workaround, avoid using password fields with the "!" character in the salt portion or passwords encrypted using DES or MD5 in FIPS-140 mode to minimize the risk of exploitation.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
X.Org Xdm
Glibc