TITLE:
X.Org X11 User Privilege Checking Security Bypass

SECUNIA ADVISORY ID:
SA19307

VERIFY ADVISORY:
http://secunia.com/advisories/19307/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
Local system

SOFTWARE:
X Window System 11 (X11) 6.x
http://secunia.com/product/3913/
X Window System 11 (X11) 7.x
http://secunia.com/product/8806/

DESCRIPTION:
A vulnerability has been reported in X11, which can be exploited by
malicious, local users to bypass certain security restrictions.

Normally, a non-root user is not allowed to pass arguments to the
"-logfile" and "-modulepath" command line options. However, an error
exists when checking a user's privileges as the address of the
"geteuid()" function is tested and not the result of the function.
This can be exploited to pass arbitrary arguments to the "-logfile"
and "-modulepath" options, which allows overwriting of arbitrary
files or execution of arbitrary code with root privileges.

The vulnerability has been reported in X.Org server 1.0.0 (as shipped
with X11R7.0) and later, X11R6.9.0 and X11R7.0 (including all release
candidates). X11R6.8.2 and prior versions are reportedly not
affected.

SOLUTION:
-- X.Org Server (X11R7) --
Apply patch for versions 1.0.0 and 1.0.1 or update to version 1.0.2.

Patches:
http://xorg.freedesktop.org/releases/X11R7.0/patches/xorg-server-1.0.1-geteuid.diff
80db6a3ab76334061ec6102e74ef5607
http://xorg.freedesktop.org/releases/X11R7.0/patches/xorg-server-1.0.1-geteuid.diff
44b44fa3efc63697eefadc7c2a1bfa50a35eec91  

-- X.Org Server (X11R6.9) --

Apply patch:
http://xorg.freedesktop.org/releases/X11R6.9.0/patches/x11r6.9.0-geteuid.diff
de85e59b8906f76a52ec9162ec6c0b63          
http://xorg.freedesktop.org/releases/X11R6.9.0/patches/x11r6.9.0-geteuid.diff
f9b73b7c1bd7d6d6db6d23741d5d1125eea5f860

PROVIDED AND/OR DISCOVERED BY:
Discovered with Coverity Prevent code audit tool and reported by
vendor.

ORIGINAL ADVISORY:
http://lists.freedesktop.org/archives/xorg/2006-March/013992.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------