Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Jul 2011 14:32:55 -0400
From: "Mike O'Connor" <>
Subject: Re: cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver

:This may be an odd request.  The proprietary fglrx driver has an
:info disclosure flaw in one of it's shell scripts [0].  It passes the

One could argue that the shell script itself is "open source".

:xauth secret cookie in an insecure manner (such that it's exposed to
:prying eyes in the output of ps for example).
:The oddness in this request is that the driver is proprietary; but
:then again it is also included in most linux distributions in one form
:or another, so I think oss-sec is an appropriate forum.  There is also
:a specific additional right granted in the script's header: "Distro
:maintainers may modify this reference script as necessary to conform
:to their distribution policies."
:This is debian bug #625868 [1], and I've commited an untested fix
:(I don't use authatieventsd myself) to our svn repo [2].
:Note that there is discussion in the bug report claiming the
:debian-specific patch is to blame, but that conclusion is incorrect.
:The same flaw is also present in the upstream ati code as well.
:The debian code is only different in that it was made to handle a
:slightly different use case, but the underlying flaw is indeed
:present in both, so other distros are very likely affected as well.
:Note also that xauth's design makes this insecure usage seem like
:an obvious solution for the cookie handling problem, so there are
:probably many other flawed implementations like this, which could
:be found by grepping for xauth and auditing those cases handling
:the secret cookie.  This may be something worth calling out as a

It looks like you've seen the same kind of thing before:

This may be worth a mention in the xauth man page.

:Credit goes to Vincent Zweije who submitted the debian bug report.
:Best wishes,
:[0] common/etc/ati/
:[2] svn://

 Michael J. O'Connor                                
"Supermodels don't usually date guys who live in the dirt."         -The Tick

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.