Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users.

A race condition existed that would allow other local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Aug 2 2007 Soren Sandmann <sandmann at redhat.com>     1.0.2-21

    - Fix bug 212167, CVE-2006-5214

    - Sun Apr 22 2007 Matthias Clasen <mclasen at       redhat.com> 1.0.2-20

    - Don't install INSTALL

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

X11 6.6.1_x86: xdm patch.
Date this patch was last updated by Sun : Jan/18/07

X11 6.6.1: xdm patch.
Date this patch was last updated by Sun : Jan/18/07

X11 6.4.1_x86: xdm patch.
Date this patch was last updated by Sun : Jan/26/07

X11 6.4.1 xdm patch.
Date this patch was last updated by Sun : Jan/26/07

ID	Name	Product	Family	Severity
27944	Ubuntu 5.10 / 6.06 LTS : xinit vulnerability (USN-364-1)	Nessus	Ubuntu Local Security Checks	low
27714	Fedora 7 : xorg-x11-xinit-1.0.2-21.fc7 (2007-1409)	Nessus	Fedora Local Security Checks	low
24410	Solaris 9 (x86) : 124831-01	Nessus	Solaris Local Security Checks	low
24407	Solaris 9 (sparc) : 124830-01	Nessus	Solaris Local Security Checks	low
23447	Solaris 8 (x86) : 111845-04	Nessus	Solaris Local Security Checks	low
23335	Solaris 8 (sparc) : 111844-04	Nessus	Solaris Local Security Checks	low

Detections

Analytics

CVE-2006-5214

medium

Tenable Plugins

low

low

low

low

low

low