[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

X Window System
Systems Affected:IRIX 5.3
Problem: The factory default Xsession for xdm under /var/X11/xdm contanst a line consisting of: 

# Gives anyone on any host access to this display
/usr/bin/X11/xhost +

This allows anyone to display aplications remotely on your machine, record all keystrokes, and log out anyone running X. For example, using SGI's endsession(1): 

$ /usr/bin/X11/endsession -f

Or using X11R6 xprop(1): 

$ /usr/bin/X11/xprop -display target.com:0.0 -root -remove _SGI_SESSION_PROPERTY

Solution: Take those xhost +'es out of everything in /var/X11/xdm.

Aleph One / aleph1@underground.org
Copyright © 1996 Computer Underground Society. All rights reserved.