Vulnerability

    Xsession

Affected

    Mandrake 7.1

Description

    Daniel  P.  Zepeda  found  following.   There  is  a  line  in the
    /etc/X11/Xsession  file  that  bypasses  the  Xauthority mechanism
    allowing  any  local  user  to  connect  to another local user's X
    session.

    While trying  to figure  out why  his ~/.Xclients  file would  not
    run, Daniel ran across this line in /etc/X11/Xsession:

        # Mandrake-Security : if you remove this comment, remove the next line too.
        /usr/X11R6/bin/xhost + localhost

    This  line  disables  the  Xauthority  mechanism on the localhost.
    Anyone logged into the localhost  can arbitrarily connect to an  X
    server running  on the  localhost.   This is  a big security hole.
    Anyone  that  can  connect  to  your  X  server  can  sniff   your
    keystrokes, see your program output etc.  This can easily lead  to
    local root  compromise if  the administrator  logged in  through X
    and executed su - and entered the root password.

    This may not  be so bad  for those that  use a single  machine for
    each user and don't setup  logins for other people on  that single
    machine.   But  for  those  of  us  that  have  large cycle-server
    machines that  have multiple  people allowed  to login  and run X,
    this can be a very large hole.

    This  has  not   been  tested  every   installation  route,   only
    "development-expert"   and   "server-custom"    both   with    the
    high-security option turned on.  The offending line is present  in
    the Xsession file on each installation.

    Daniel also found that the  ssh-agent handling is very poor.   The
    Xsession file does not allow  the ~/.Xclients file ever to  be run
    when run under [xkg]dm. When run under [xkg]dm there is no ability
    to add new keys to  the agent automatically.  Also, Xsession makes
    assumptions about the version and usage of SSH that should not  be
    present in the Xsession file, but  should be put in the the  users
    ~/.Xclients file.

Solution

    Remove  the  following  line  in  the  /etc/X11/Xsession  file and
    restart X.

        /usr/X11R6/bin/xhost + localhost

    All present users should have the revised ~./Xclients file  placed
    in  their  home  directories.  Ensure  the  permissions  for   the
    ~/.Xclients file is 0700 and owned by the user.

    For Linux-Mandrake:

        Linux-Mandrake 7.0: 7.0/RPMS/xinitrc-2.4.4-11mdk.noarch.rpm
                            7.0/SRPMS/xinitrc-2.4.4-11mdk.src.rpm
        Linux-Mandrake 7.1: 7.1/RPMS/xinitrc-2.4.4-24mdk.noarch.rpm
                            7.1/SRPMS/xinitrc-2.4.4-24mdk.src.rpm