oss-security - Re: request CVE id: insecure handling of DISPLAY in rxvt

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 4 Mar 2008 22:34:10 +0000
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: Re: request CVE id: insecure handling of DISPLAY in
	rxvt

On Tue Mar 04, 2008 at 16:51:42 -0500, Steven M. Christey wrote:

> > "If the DISPLAY environment is not set, rxvt opens an xterm
> > on :0, which on some headless login-server means anyone can setup
> > an fake X server waiting for someone loggin in without X
> > forwarding to start rxvt by some mistake or by some program (thus
> > without even noticing) and getting full shell access to that other
> > account."
> >
> > This is Debian bug 469296[0].
> 
> Use CVE-2008-1142
> 
> I'm not going to pretend to understand this issue, plus Lubomir's bug
> comment raises the question of dependency on user error (though it's
> probably a relatively common error, I'd think).  So, I'll fill in the CVE
> later once this has been fleshed out.

  It seems like an issue which I'd almost be tempted to say isn't
 a security one.

  The idea is that if you typically connect to a host with display
 forwarding you'll be used to running rxvt and having the resulting
 application display locally.

  However if you forget to enable display forwarding then run
 RXVT it will connect to :1, rather than complain there is no
 DISPLAY set and abort.  That *could* allow a malicious local
 server to steal keyboard, & etc.

  However I have a hard time seeing this in practise.  It would
 mean that locally you couldn't trust root - since it would take
 a local root user to setup the fake X11 server on :1..

  This attack is like saying that if you forget to open your
 eyes you might accidentally walk into the wrong house and
 have people see what you're doing..

Steve
-- 
http://www.steve.org.uk/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.