{"vuid":"VU#139504","idnumber":"139504","name":"Sun Solaris X Display Manager does not properly handle invalid XDMCP requests","keywords":["Sun","Solaris","xdm(1)","XDMCP","X Display Manager","X Display Manager Control Protocol","denial of service","DoS"],"overview":"There is a vulnerability in the way Sun Solaris handles invalid X Display Manager Control Protocol (XDMCP) requests. Exploitation of this vulnerability could allow an attacker to cause the X Display Manager (XDM) to crash.","clean_desc":"The X Display Manager (xdm(1)) is responsible for managing collections of X displays from local or remote servers using the X Display Manager Control Protocol (XDMCP). The Sun Solaris X Display Manager contains a denial-of-service vulnerability that could be triggered by an invalid XDMCP packet.","impact":"A remote attacker with the ability to send XDMCP packets to a vulnerable system could cause the X Display Manager to crash.","resolution":"Apply patch\nSun has issued an advisory which addresses this issue. For more information on patches available for your system, please refer to Sun Security Alert 57619.","workarounds":"Restrict access Block or restrict UDP(7P) packets destined for port 177/udp from untrusted networks such as the Internet. Disable XDMCP connections According to the Sun Security Alert, xdm(1M) can be configured to not listen for XDMCP connections by editing the \"/usr/openwin/lib/X11/xdm/xdm-config\" file and adding the following line: DisplayManager.requestPort: 0 Note: Controlling access via the access control list in the \"Xaccess\" file is not effective at preventing this issue.","sysaffected":"","thanks":"This vulnerability was reported by Sun Microsystems.","author":"This document was written by Damon Morda.","public":["http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57619","http://secunia.com/advisories/12257/"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-08-11T13:27:03Z","publicdate":"2004-08-09T00:00:00Z","datefirstpublished":"2004-08-11T18:38:51Z","dateupdated":"2004-08-11T18:39:09Z","revision":16,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"15","cam_population":"15","cam_impact":"3","cam_easeofexploitation":"10","cam_attackeraccessrequired":"17","cam_scorecurrent":"4.303125","cam_scorecurrentwidelyknown":"5.0203125","cam_scorecurrentwidelyknownexploited":"7.8890625","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":4.303125,"vulnote":null}