Bugtraq mailing list archives
xnews and XDM
From: hartmans () bga com (Sam Hartman)
Date: Thu, 21 Jul 1994 07:34:40 -0500
Date: Wed, 20 Jul 1994 19:52:18 -0500 From: Sam Hartman <hartmans () bga com> Sender: bugtraq-owner () crimelab com Precedence: bulk AIX has a similar hole. The DPS server can be entered by /usr/lpp/DPS/bin/dpsexec. Since X runs as root, you can then open and write to any root owned file. I haven't bothered to write an exploit script, but I did try running /etc/security/passwd, and I got a root: UndefinedCommand error. Someone opened a bug against this inside IBM--I forget who, but to my knowledge, know action has been taken. --Sam I was a little too hastey when I wrote this; while it is accurate, it is rather incomplete: naturally, it requires that DPS be enabled for the problem to exist. In fact, you could make a good argument that it is a configuration problem, as the shipped state of DPS is disabled when running under XDM. Still, it's an issue to be aware of; I've seen two or three posts to comp.unix.aix in response to "Why doesn't DPS work under XDM," with "Well, insert `-x DPS' into /usr/lib/X11/xdm/Xservers. If you have done this, consider removing it, or disabling XDM. --Sam
Current thread:
- xnews and XDM Sam Hartman (Jul 20)
- Re: xnews and XDM Vatsal P. Sonecha (Jul 20)
- xnews and XDM Sam Hartman (Jul 21)
- /etc/subnetconfig Aleph One (Jul 20)
- xnews and XDM Sam Hartman (Jul 21)
- Possible Ultrix issue A. Rich (Jul 21)
- Re: xnews and XDM Vatsal P. Sonecha (Jul 20)