Vulnerability Development mailing list archives

Re: Problem with xkill


From: Valdis.Kletnieks () vt edu
Date: Fri, 22 Mar 2002 17:09:15 -0500

On Fri, 22 Mar 2002 14:54:03 EST, Anthony Gruppuso said:

I don't know what possesed me to try this, but under Digital UNIX 5.0,
as a normal user, I was able to set my DISPLAY to the IP address of
another user who was running a seperate session, and run xkill.

xkill (like any other X client) uses the standard X access control scheme.

Most likely, the other user had done an 'xhost +' or 'xhost +yourhost'.

That's why xauth and friends exist, to stop games like this...

-- 
                                Valdis Kletnieks
                                Computer Systems Senior Engineer
                                Virginia Tech

Attachment: _bin
Description:


Current thread: