Date: Fri, 20 Nov 2015 13:26:53 -0500 (EST) From: cve-assign@...re.org To: thoger@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: LXDM X authentication issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > LXDM before 0.5.2 did not start X server with -auth parameter. > Therefore any user able to connect to it (typically all local users) > would have their X connections accepted. The issue was fixed via: > > http://git.lxde.org/gitweb/?p=lxde/lxdm.git;a=commit;h=e8f387089e241360bdc6955d3e479450722dcea3 >> pass xauth file to xserver command It appears that this is the major finding. Use CVE-2015-8308. > LXDM also defaults to not restarting X server between sessions, and > does not change authentication cookies or remove xhost authorizations. > This allows local user to be able to connect to the X server after they > logged out. The 'reset' option in lxdm.conf controls whether X server > is restarted on session user close. This possibly can be included in CVE but, if so, the CVE ID would be different. Is there any other information, e.g., why was there a decision to make reset an optional behavior rather than a required behavior? Is there a possible attack by a different local user, or is the relevant attack that someone could steal the computer and recover the authentication cookies (possibly violating an expectation of the legitimate user who believed they were safely logged out)? Is the behavior different from all major display managers? http://wiki.lxde.org/en/LXDM says "LXDM is the lightweight display manager ..." -- is the design tradeoff possibly different on a low-resource machine where it's very expensive to restart the X server? - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWT2WBAAoJEL54rhJi8gl50F8QAIGlLgPJfDdmpJy6jGd32eEd S20uQCZUpZY9OADmAm5TNJsXCuCxoypnPb6/RDNymiTl+Z22qtmwiXDQqMFWD5EN nwxJfVJHM2eWEpCo0ZF8Ocn7yZm/MQKGbPEMqKIXe3TjOEAn92is4bzOq2DFCRe3 g9aKxKCOG0B6zv8T7z3pO/BF9HvkFskmEopMA6DCDCQVJjZ0eE7p/oF9U/XCoG1v 4TQVsuPl2ojAYmowZ4kFGgMnWcA5QKL3bwlddCWVbaEFpj59uznWvcFpfzc7WEnW WVPFyqeTMaIsCC8APVRNXvKfi6xKxngofA5V0lFGOMvltCEIyJVOP1quHJuyyEMh 7B3246JT0Gt7Z2rlKpfRuTIM5sas0GWdODCtVhE6+h2Ym2gcKmdnspgfBEsqoSAJ IgqVoO1Hhjv0ozoNOgcgw+JyBLS7yus6jHWrhzlCeKGN0RXpEQlrEzHLTGKJq7K3 sd8sTwFFntIfpDDwUqeC+8JUhaLB7AGzVYJtfPeHRQAI5OxGSRxhVd51bDREfRtl BVVSVb9lYV81NQkAqHluT6MIHQWGGXdo/DocpbJsRUiWYqSUVXTLk3VcUnKRPtYY 3pZHzWjzuU+/jSg123onftMond/HBqYEC9pRICbRQScv7QE/eOSuUHzP5FovW30N 71swFR6kDua+AGm6F6rY =59AY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ