KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module.

A number of vulnerabilities have been discovered in XFree86. The corrections are listed below with the identification from the Common Vulnerabilities and Exposures (CVE) project :

  - CAN-2004-0083 :
    Buffer overflow in ReadFontAlias from dirfile.c of     XFree86 4.1.0 through 4.3.0 allows local users and     remote attackers to execute arbitrary code via a font     alias file (font.alias) with a long token, a different     vulnerability than CAN-2004-0084.

  - CAN-2004-0084 :

    Buffer overflow in the ReadFontAlias function in XFree86     4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered     function, allows local or remote authenticated users to     execute arbitrary code via a malformed entry in the font     alias (font.alias) file, a different vulnerability than     CAN-2004-0083.

  - CAN-2004-0106 :

    Miscellaneous additional flaws in XFree86's handling of     font files.

  - CAN-2003-0690 :

    xdm does not verify whether the pam_setcred function     call succeeds, which may allow attackers to gain root     privileges by triggering error conditions within PAM     modules, as demonstrated in certain configurations of     the MIT pam_krb5 module.

  - CAN-2004-0093, CAN-2004-0094 :

    Denial-of-service attacks against the X server by     clients using the GLX extension and Direct Rendering     Infrastructure are possible due to unchecked client data     (out-of-bounds array indexes [CAN-2004-0093] and integer     signedness errors [CAN-2004-0094]).

Exploitation of CAN-2004-0083, CAN-2004-0084, CAN-2004-0106, CAN-2004-0093 and CAN-2004-0094 would require a connection to the X server. By default, display managers in Debian start the X server with a configuration which only accepts local connections, but if the configuration is changed to allow remote connections, or X servers are started by other means, then these bugs could be exploited remotely.
Since the X server usually runs with root privileges, these bugs could potentially be exploited to gain root privileges.

No attack vector for CAN-2003-0690 is known at this time.

Two vulnerabilities were discovered in kdebase :

  - CAN-2003-0690 :
    KDM in KDE 3.1.3 and earlier does not verify whether the     pam_setcred function call succeeds, which may allow     attackers to gain root privileges by triggering error     conditions within PAM modules, as demonstrated in     certain configurations of the MIT pam_krb5 module.

  - CAN-2003-0692 :

    KDM in KDE 3.1.3 and earlier uses a weak session cookie     generation algorithm that does not provide 128 bits of     entropy, which allows attackers to guess session cookies     via brute-force methods and gain access to the user     session.

These vulnerabilities are described in the following security advisory from KDE :

A vulnerability was discovered in the XDM display manager that ships with XFree86. XDM does not check for successful completion of the pam_setcred() call and in the case of error conditions in the installed PAM modules, XDM may grant local root access to any user with valid login credentials. It has been reported that a certain configuration of the MIT pam_krb5 module can result in a failing pam_setcred() call which leaves the session alive and would provide root access to any regular user. It is also possible that this vulnerability can likewise be exploited with other PAM modules in a similar manner.

A backported patch from XFree86 4.3 that corrects this vulnerability has been applied to these updated packages.

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pam_setcred() call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It has been reported to the KDE team that a certain configuration of the MIT pam_krb5 module can result in a failing pam_setcred() call which leaves the session alive and would provide root access to any regular user. It is also possible that this vulnerability can likewise be exploited with other PAM modules in a similar manner.

Another vulnerability was discovered in kdm where the cookie session generating algorithm was considered too weak to supply a full 128 bits of entropy. This allowed unauthorized users to brute-force the session cookie.

mdkkdm, a specialized version of kdm, is likewise vulnerable to these problems and has been patched as well.

Updated XFree86 packages provide security fixes to font libraries and XDM.

XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. XDM is the X display manager.

Multiple integer overflows in the transfer and enumeration of font libraries in XFree86 allow local or remote attackers to cause a denial of service or execute arbitrary code via heap-based and stack-based buffer overflow attacks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0730 to this issue.

The risk to users from this vulnerability is limited because only clients can be affected by these bugs, however in some (non-default) configurations, both xfs and the X Server can act as clients to remote font servers.

XDM does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the pam_krb5 module. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0690 to this issue.

Users are advised to upgrade to these updated XFree86 4.1.0 packages, which contain backported security patches and are not vulnerable to these issues.

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available.

KDE is a graphical desktop environment for the X Window System.

KDE between versions 2.2.0 and 3.1.3 inclusive contain a bug in the KDE Display Manager (KDM) when checking the result of a pam_setcred() call. If an error condition is triggered by the installed PAM modules, KDM might grant local root access to any user with valid login credentials.

It has been reported that one way to trigger this bug is by having a certain configuration of the MIT pam_krb5 module that leaves a session alive and gives root access to a regular user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0690 to this issue.

In addition, the session cookie generation algorithm used by KDM was considered too weak to supply a full 128 bits of entropy. This could make it possible for non-authorized users, who are able to bypass any host restrictions, to brute-force the session cookie and gain acess to the current session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0692 to this issue.

Users of KDE are advised to upgrade to these erratum packages, which contain security patches correcting these issues.

Red Hat would like to thank the KDE team for notifying us of this issue and providing the security patches.

ID	Name	Product	Family	Severity
15280	Debian DSA-443-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
15225	Debian DSA-388-1 : kdebase - several vulnerabilities	Nessus	Debian Local Security Checks	critical
14100	Mandrake Linux Security Advisory : XFree86 (MDKSA-2003:118)	Nessus	Mandriva Local Security Checks	critical
14073	Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)	Nessus	Mandriva Local Security Checks	critical
12424	RHEL 2.1 : XFree86 (RHSA-2003:289)	Nessus	Red Hat Local Security Checks	critical
12419	RHEL 2.1 : kdebase (RHSA-2003:270)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2003-0690

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical