xdm(1) XDMCP request denial of service
| xdm-xdmcp-dos (16940) |  Medium Risk |
Description:
The XFree86 xdm (xdm(1) (X Display Manager) is vulnerable to a denial of service attack. A remote unauthenticated attacker could send an invalid XDMCP (X Display Manager Control Protocol) request to cause the xdm(1) service to crash.
Consequences:
Denial of Service
Remedy:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57619 for more information. See References.
SPARC Platform
Solaris 8 with patch 111844-03 or later
Solaris 9 with patch 112785-38 or later
x86 Platform
Solaris 8 with patch 111845-03 or later
Solaris 9 with patch 112786-27 or later
As a workaround, follow the instructions as listed in Sun Alert ID: 57619. See References.
References:
- Sun Alert ID: 57619: X Display Manager (xdm(1)) May Crash Due to Invalid XDMCP Request.
- Sun Alert ID: 57619: X Display Manager (xdm(1)) May Crash Due to Invalid XDMCP Request.
- Sun Alert ID: 57619: X Display Manager (xdm(1)) May Crash Due to Invalid XDMCP Request.
- BID-10911: Sun Solaris XDMCP Unspecified Denial Of Service Vulnerability
- CVE-2004-1347: X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request.
- SA12257: Sun Solaris XDMCP Parsing Vulnerability
- US-CERT VU#139504: Sun Solaris X Display Manager does not properly handle invalid XDMCP requests
Platforms Affected:
- Sun Solaris 7.0 x86
- Sun Solaris 7.0 SPARC
- Sun Solaris 8 SPARC
- Sun Solaris 8 x86
- Sun Solaris 9 x86
- Sun Solaris 9 SPARC
- XFree86 xdm
Reported:
Aug 09, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net