X.Org X11 X -sp command information disclosure
| xorg-xsp-information-disclosure (39769) |  Low Risk |
Description:
X.Org X11 could allow a local attacker to obtain sensitive information, caused by the improper processing of security policy arguments. By sending the file name as a command line argument to the X -sp command, a local attacker could disclose the existence of restricted files and obtain sensitive information.
*CVSS:
| Base Score: | 2.1 |
| Access Vector: | Local |
| Access Complexity: | Low |
| Authentication: | None |
| Confidentiality Impact: | Partial |
| Integrity Impact: | None |
| Availability Impact: | None |
| Temporal Score: | 1.7 |
| Exploitability: | Functional |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Obtain Information
Remedy:
Upgrade to the latest version of X.org X11 (1.4 or later), available from the X.Org Foundation Web site. See References.
For Sun Solaris:
Refer to Sun Alert ID: 103205 for patch, upgrade, or suggested workaround information. See References.
For Mac OS X:
Apply Security Update 2008-002, available from the Apple Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
References:
- Apple Web site: About Security Update 2008-002.
- HPSBUX02381 SSRT080083 rev.1: HP-UX Running Xserver, Remote Execution of Arbitrary Code.
- Sun Alert ID: 230901: Security Vulnerability in the Solaris X Server May Lead to Unauthorized Disclosure of Information on Access Restricted Files and Directories.
- X.Org Foundation Web site: X.Org Wiki - Home.
- X.Org Mailing List, Thu Jan 17 06:05:34 PST 2008: X.Org security advisory: multiple vulnerabilities in the X server.
- ASA-2008-035: XFree86 security update (RHSA-2008-0029)
- ASA-2008-036: xorg-x11 security update (RHSA-2008-0030)
- ASA-2008-037: Security Vulnerability in the Solaris X Server May Lead to Unauthorized Disclosure of Information on Access Restricted Files and Directories (Sun 103205)
- ASA-2008-084: Security Vulnerability in the Solaris X Server May Lead to Unauthorized Disclosure of Information on Access Restricted Files and Directories (Sun 230901)
- ASA-2008-431: HPSBUX02381 SSRT080083 rev.1 - HP-UX Running Xserver Remote Execution of Arbitrary Code
- BID-27336: RETIRED: X.Org X Server Local Privilege Escalation and Information Disclosure Vulnerabilities
- BID-27356: X.Org X 'Server X:1 -sp' Command Information Disclosure Vulnerability
- CVE-2007-5958: X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists.
- DSA-1466: xorg-server -- several vulnerabilities
- GLSA-200801-09: X.Org X server and Xfont library: Multiple vulnerabilities
- MDVSA-2008:021: Updated XFree86 packages fix multiple vulnerabilities
- MDVSA-2008:022: Updated xorg-x11 packages fix multiple vulnerabilities
- MDVSA-2008:023: Updated x11-server packages fix multiple vulnerabilities
- MDVSA-2008:025: Updated x11-server-xgl packages fix multiple vulnerabilities
- RHSA-2008-0029: Important: XFree86 security update
- RHSA-2008-0030: Important: xorg-x11 security update
- RHSA-2008-0031: Important: xorg-x11-server security update
- SA28532: X.org X11 Multiple Vulnerabilities
- SA28550: Sun Solaris X Window System and X Server Multiple Vulnerabilities
- SA28885: NX Server X11 Multiple Vulnerabilities
- SA28997: Avaya CMS Solaris X Window System Information Disclosure
- SA29420: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SA30161: Gentoo ltsp Multiple Vulnerabilities
- SA32545: HP-UX Xserver Multiple Vulnerabilities
- SECTRACK ID: 1019232: X Server Bugs in XFree86, Xinput, TOG-CUP, MIT-SHM, and EVI Extensions Let Local Users Gain Root Privileges
- SUSE-SA:2008:003: Xorg Security Problems
- SUSE-SR:2008:008: SUSE Security Summary Advisory
- USN-571-1: X.org vulnerabilities
- USN-571-2: X.org regression
- VUPEN/ADV-2008-0179: X.Org X11 Integer Overflow and Memory Corruption Vulnerabilities
- VUPEN/ADV-2008-0184: Sun Solaris X Windows Integer Overflow and Memory Corruption Issues
- VUPEN/ADV-2008-0497: NoMachine NX Server Security Update Fixes X11 Multiple Vulnerabilities
- VUPEN/ADV-2008-0924: Apple Mac OS X Command Execution and Security Bypass Issues
- VUPEN/ADV-2008-3000: HP-UX Xserver Multiple Remote Code Execution Vulnerabilities
Platforms Affected:
- Apple Mac OS X 10.4.11
- Apple Mac OS X 10.5.2
- Apple Mac OS X Server 10.4.11
- Apple Mac OS X Server 10.5.2
- Canonical Ubuntu 6.06 LTS
- Canonical Ubuntu 6.10
- Canonical Ubuntu 7.04
- Canonical Ubuntu 7.10
- Debian Debian Linux 3.1
- Debian Debian Linux 4.0
- Gentoo Linux
- HP HP-UX B.11.11
- MandrakeSoft Mandrake Linux 2007 X86_64
- MandrakeSoft Mandrake Linux 2007
- MandrakeSoft Mandrake Linux 2007.1 X86_64
- MandrakeSoft Mandrake Linux 2007.1
- MandrakeSoft Mandrake Linux 2008.0 X86_64
- MandrakeSoft Mandrake Linux 2008.0
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 4.0
- MandrakeSoft Mandrake Linux Corporate Server 4.0 X86_64
- Novell Linux Desktop 9
- Novell Linux POS 9
- Novell Open Enterprise Server
- Novell Open Enterprise Server
- Novell OpenSUSE 10.2
- Novell OpenSUSE 10.3
- Novell SLE SDK 10
- Novell SLE SDK 10 SP1
- Novell SUSE Linux Enterprise Desktop 10 SP1
- Novell SUSE Linux Enterprise Server 10
- Novell SUSE Linux Enterprise Server 10 SP1
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 WS
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 4 Desktop
- RedHat Enterprise Linux 4 WS
- RedHat Enterprise Linux 4 ES
- RedHat Enterprise Linux 4 AS
- RedHat Enterprise Linux 5 Client Workstation
- RedHat Enterprise Linux 5
- RedHat Enterprise Linux 5 Client
- RedHat Linux Advanced Workstation 2.1 Itanium
- Sun Solaris 10 x86
- Sun Solaris 10 SPARC
- Sun Solaris 8 x86
- Sun Solaris 8 SPARC
- Sun Solaris 9 x86
- Sun Solaris 9 SPARC
- SUSE SuSE Linux 9.0
- SuSE SuSE SLES 9
- X.Org X11 R7.3
Reported:
Jan 17, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.