bugtraq - MDKSA-2004:073 - Updated XFree86 packages fix issue with xdm opening random sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040728001422.26782.qmail@updates.mandrakesoft.com>
Date: 28 Jul 2004 00:14:22 -0000
From: Mandrake Linux Security Team <security@...ux-mandrake.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2004:073 - Updated XFree86 packages fix issue with xdm opening random sockets


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           XFree86
 Advisory ID:            MDKSA-2004:073
 Date:                   July 27th, 2004

 Affected versions:	 10.0
 ______________________________________________________________________

 Problem Description:

 Steve Rumble discovered XDM in XFree86 opens a chooserFd TCP socket
 even when DisplayManager.requestPort is 0, which could allow remote
 attackers to connect to the port, in violation of the intended
 restrictions.
 
 The updated packages are patched to correct the problem.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0419
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 3d8f7cc32efa365598c0eab6362afcd0  10.0/RPMS/X11R6-contrib-4.3-32.1.100mdk.i586.rpm
 b4172fffca6936486827260143583beb  10.0/RPMS/XFree86-100dpi-fonts-4.3-32.1.100mdk.i586.rpm
 76e708133439aa6a251945b3d272efd7  10.0/RPMS/XFree86-4.3-32.1.100mdk.i586.rpm
 883614a82021c8f630e05dc836e73735  10.0/RPMS/XFree86-75dpi-fonts-4.3-32.1.100mdk.i586.rpm
 860343cbb4f8987aba1b51244509e3ca  10.0/RPMS/XFree86-Xnest-4.3-32.1.100mdk.i586.rpm
 83fdeaa5626d268b3b5c79f2c9e9c9da  10.0/RPMS/XFree86-Xvfb-4.3-32.1.100mdk.i586.rpm
 ee27e16339c3fe869115612f878b6f9a  10.0/RPMS/XFree86-cyrillic-fonts-4.3-32.1.100mdk.i586.rpm
 280be6f30a08df7d9df6b14a95bac395  10.0/RPMS/XFree86-doc-4.3-32.1.100mdk.i586.rpm
 e80cfe469c9815ecf22b9075abc9903b  10.0/RPMS/XFree86-glide-module-4.3-32.1.100mdk.i586.rpm
 fda7bdf5de0baedb92da3b0d4a3ce6f2  10.0/RPMS/XFree86-server-4.3-32.1.100mdk.i586.rpm
 7e69712264c38cdc67bbcde303f24386  10.0/RPMS/XFree86-xfs-4.3-32.1.100mdk.i586.rpm
 e771f892d01a646f35098241a93fbd58  10.0/RPMS/libxfree86-4.3-32.1.100mdk.i586.rpm
 418d499c3c469dcfdfafb08d7549b560  10.0/RPMS/libxfree86-devel-4.3-32.1.100mdk.i586.rpm
 19b713df27c5f9c739db32bf23b556c8  10.0/RPMS/libxfree86-static-devel-4.3-32.1.100mdk.i586.rpm
 acbd5f8c90422416215df5d2fa686f88  10.0/SRPMS/XFree86-4.3-32.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 70773e362c8de210f9da4dc4693d1812  amd64/10.0/RPMS/X11R6-contrib-4.3-32.1.100mdk.amd64.rpm
 c74d80d2e64aef5a408b62c3512205c1  amd64/10.0/RPMS/XFree86-100dpi-fonts-4.3-32.1.100mdk.amd64.rpm
 dcb88ecdc48de0577af670c5af9609ac  amd64/10.0/RPMS/XFree86-4.3-32.1.100mdk.amd64.rpm
 d603e47eaf801b471bb68c308920bc48  amd64/10.0/RPMS/XFree86-75dpi-fonts-4.3-32.1.100mdk.amd64.rpm
 dfdee3789f1963dc7b9d2b7b52a93a0f  amd64/10.0/RPMS/XFree86-Xnest-4.3-32.1.100mdk.amd64.rpm
 3cca29110317b32fba9f5825ed00867f  amd64/10.0/RPMS/XFree86-Xvfb-4.3-32.1.100mdk.amd64.rpm
 32963c84575ca591d8945a8418a7f362  amd64/10.0/RPMS/XFree86-cyrillic-fonts-4.3-32.1.100mdk.amd64.rpm
 c8f3c91b813703d57611087249eabc0d  amd64/10.0/RPMS/XFree86-doc-4.3-32.1.100mdk.amd64.rpm
 3eafba88d255666197aea3a62e276b61  amd64/10.0/RPMS/XFree86-server-4.3-32.1.100mdk.amd64.rpm
 18a8c7471ccb535a49322e4fe334f933  amd64/10.0/RPMS/XFree86-xfs-4.3-32.1.100mdk.amd64.rpm
 fd24efdfcce22c9fdeb27301f06ced49  amd64/10.0/RPMS/lib64xfree86-4.3-32.1.100mdk.amd64.rpm
 9b67ee689be268c4386fde4e81f3a2e3  amd64/10.0/RPMS/lib64xfree86-devel-4.3-32.1.100mdk.amd64.rpm
 4fd3a12d07c268d20a3bc80172b616fb  amd64/10.0/RPMS/lib64xfree86-static-devel-4.3-32.1.100mdk.amd64.rpm
 acbd5f8c90422416215df5d2fa686f88  amd64/10.0/SRPMS/XFree86-4.3-32.1.100mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBBu/emqjQ0CJFipgRAhnyAKDaqv2/JyGo3CDinFm6ana6OdFmQACaAuDB
0ar0MPcg1gso8/LQQ9WZozY=
=mMJG
-----END PGP SIGNATURE-----