{"vuid":"VU#837857","idnumber":"837857","name":"X.Org server fails to properly test for effective user ID","keywords":["xorg","x.org","x11","geteuid","privilege escalation","arbitrary code execution","unauthorized data modification","modulepath option","logfile option"],"overview":"A vulnerability in the X.Org server could allow a local attacker to gain administrative privileges or cause a denial of service on an affected system.","clean_desc":"The X.Org server program provides several command-line options that are meant to be parsed only when the program is running as root. These include -modulepath, which specifies the location from which to load modules providing server functionality, and -logfile, which specifies the location of the server log file. Normally, these options cannot be changed by unprivileged users. A flaw exists in the way that the server enforces this restriction because it evaluates the address of the geteuid function instead of the result of executing the function (i.e., \"geteuid\" versus \"geteuid()\"). This test is flawed because the address of geteuid is guaranteed to be nonzero. As a result, an unprivileged user can load modules from any location on the file system with root privileges or overwrite critical system files with the server log.","impact":"If the X.Org server program is setuid to root, as is typically the case, an authenticated local attacker can execute code or overwrite system files with administrative privileges on an affected system.","resolution":"Apply a patch from the vendor Patches have been released to address this issue. Users should consult the Systems Affected section of this document for information about specific vendors. Users who compile the X.Org server from source code or obtain binary releases directly from X.Org are encouraged to take the actions specified in the corresponding X.Org Security Advisory.","workarounds":"","sysaffected":"","thanks":"Thanks to \nthe\n X.Org Foundation\n for reporting this vulnerability. They, in turn, credit \nCoverity with discovering and reporting this vulnerability to them.","author":"This document was written by Chad R Dougherty.","public":["http://lists.freedesktop.org/archives/xorg/2006-March/013858.html","http://www.securityfocus.com/bid/17169","http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:056","http://secunia.com/advisories/19256/","http://secunia.com/advisories/19311/","http://secunia.com/advisories/19316/","http://secunia.com/advisories/19307/","http://www.auscert.org.au/6142","http://sunsolve.sun.com/search/document.do?assetkey=1-26-102252-1","http://www.auscert.org.au/6142"],"cveids":["CVE-2006-0745"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-03-21T15:03:47Z","publicdate":"2006-03-20T00:00:00Z","datefirstpublished":"2006-08-16T13:58:42Z","dateupdated":"2009-11-20T19:16:28Z","revision":17,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"15","cam_impact":"19","cam_easeofexploitation":"15","cam_attackeraccessrequired":"10","cam_scorecurrent":"18.4359375","cam_scorecurrentwidelyknown":"18.4359375","cam_scorecurrentwidelyknownexploited":"34.4671875","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":18.4359375,"vulnote":null}