The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.

The remote Solaris system is missing necessary patches to address security updates :

  - The LockServer function in os/utils.c in X.Org xserver     before 1.11.2 allows local users to determine the     existence of arbitrary files via a symlink attack on a     temporary lock file, which is handled differently if the     file exists. (CVE-2011-4028)

  - The LockServer function in os/utils.c in X.Org xserver     before 1.11.2 allows local users to change the     permissions of arbitrary files to 444, read those files,     and possibly cause a denial of service (removed     execution permission) via a symlink attack on a     temporary lock file. (CVE-2011-4029)

The X server had two security issues and one bug that is fixed by this update.

CVE-2011-4028: It is possible for a local attacker to deduce if a file exists or not by exploiting the way that Xorg creates its lock files.

CVE-2011-4029: It is possible for a non-root local user to set the read permission for all users on any file or directory.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

From Red Hat Security Advisory 2012:0939 :

Updated xorg-x11-server packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

Red Hat would like to thank the researcher with the nickname vladz for reporting these issues.

This update also fixes the following bugs :

* Prior to this update, the KDE Display Manager (KDM) could pass invalid 24bpp pixmap formats to the X server. As a consequence, the X server could unexpectedly abort. This update modifies the underlying code to pass the correct formats. (BZ#651934, BZ#722860)

* Prior to this update, absolute input devices, like the stylus of a graphic tablet, could become unresponsive in the right-most or bottom-most screen if the X server was configured as a multi-screen setup through multiple 'Device' sections in the xorg.conf file. This update changes the screen crossing behavior so that absolute devices are always mapped across all screens. (BZ#732467)

* Prior to this update, the misleading message 'Session active, not inhibited, screen idle. If you see this test, your display server is broken and you should notify your distributor.' could be displayed after resuming the system or re-enabling the display, and included a URL to an external web page. This update removes this message.
(BZ#748704)

* Prior to this update, the erroneous input handling code of the Xephyr server disabled screens on a screen crossing event. The focus was only on the screen where the mouse was located and only this screen was updated when the Xephyr nested X server was configured in a multi-screen setup. This update removes this code and Xephyr now correctly updates screens in multi-screen setups. (BZ#757792)

* Prior to this update, raw events did not contain relative axis values. As a consequence, clients which relied on relative values for functioning did not behave as expected. This update sets the values to the original driver values instead of the already transformed values.
Now, raw events contain relative axis values as expected. (BZ#805377)

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

This update of xorg-x11-server-rdp fixed the following security issues :

  - memory exhaustion flaw CVE-2011-4028 / CVE-2011-4029 -     race condition flaw. (CVE-2010-2240)

This update of xorg-x11-server-dmx fixed the following security issues :

  - memory exhaustion flaw CVE-2011-4028 / CVE-2011-4029 -     race condition flaw. (CVE-2010-2240)

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

This update also fixes the following bugs :

  - Prior to this update, the KDE Display Manager (KDM)     could pass invalid 24bpp pixmap formats to the X server.
    As a consequence, the X server could unexpectedly abort.
    This update modifies the underlying code to pass the     correct formats.

  - Prior to this update, absolute input devices, like the     stylus of a graphic tablet, could become unresponsive in     the right-most or bottom-most screen if the X server was     configured as a multi-screen setup through multiple     'Device' sections in the xorg.conf file. This update     changes the screen crossing behavior so that absolute     devices are always mapped across all screens.

  - Prior to this update, the misleading message 'Session     active, not inhibited, screen idle. If you see this     test, your display server is broken and you should     notify your distributor.' could be displayed after     resuming the system or re-enabling the display, and     included a URL to an external web page. This update     removes this message.

  - Prior to this update, the erroneous input handling code     of the Xephyr server disabled screens on a screen     crossing event. The focus was only on the screen where     the mouse was located and only this screen was updated     when the Xephyr nested X server was configured in a     multi-screen setup. This update removes this code and     Xephyr now correctly updates screens in multi-screen     setups.

  - Prior to this update, raw events did not contain     relative axis values. As a consequence, clients which     relied on relative values for functioning did not behave     as expected. This update sets the values to the original     driver values instead of the already transformed values.
    Now, raw events contain relative axis values as     expected.

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

Updated xorg-x11-server packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

Red Hat would like to thank the researcher with the nickname vladz for reporting these issues.

This update also fixes the following bugs :

* Prior to this update, the KDE Display Manager (KDM) could pass invalid 24bpp pixmap formats to the X server. As a consequence, the X server could unexpectedly abort. This update modifies the underlying code to pass the correct formats. (BZ#651934, BZ#722860)

* Prior to this update, absolute input devices, like the stylus of a graphic tablet, could become unresponsive in the right-most or bottom-most screen if the X server was configured as a multi-screen setup through multiple 'Device' sections in the xorg.conf file. This update changes the screen crossing behavior so that absolute devices are always mapped across all screens. (BZ#732467)

* Prior to this update, the misleading message 'Session active, not inhibited, screen idle. If you see this test, your display server is broken and you should notify your distributor.' could be displayed after resuming the system or re-enabling the display, and included a URL to an external web page. This update removes this message.
(BZ#748704)

* Prior to this update, the erroneous input handling code of the Xephyr server disabled screens on a screen crossing event. The focus was only on the screen where the mouse was located and only this screen was updated when the Xephyr nested X server was configured in a multi-screen setup. This update removes this code and Xephyr now correctly updates screens in multi-screen setups. (BZ#757792)

* Prior to this update, raw events did not contain relative axis values. As a consequence, clients which relied on relative values for functioning did not behave as expected. This update sets the values to the original driver values instead of the already transformed values.
Now, raw events contain relative axis values as expected. (BZ#805377)

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

This update fixes two security issues with the X server :

  - A local attacker could find out if a file exists by     exploiting the way that Xorg creates its lock files.
    (CVE-2011-4028)

  - A non-root local user could set the read permission for     all users on any file or directory. (CVE-2011-4029)

The remote host is affected by the vulnerability described in GLSA-201110-19 (X.Org X Server: Multiple vulnerabilities)

    vladz reported the following vulnerabilities in the X.Org X server:
      The X.Org X server follows symbolic links when trying to access the         lock file for a X display, showing a predictable behavior depending on         the file type of the link target (CVE-2011-4028).
      The X.Org X server lock file mechanism allows for a race condition to         cause the X server to modify the file permissions of an arbitrary file         to 0444 (CVE-2011-4029).
  Impact :

    A local attacker could exploit these vulnerabilities to disclose       information by making arbitrary files on a system world-readable or gain       information whether a specified file exists on the system and whether it       is a file, directory, or a named pipe.
  Workaround :

    There is no known workaround at this time.

USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support, and USN-1232-2 was released to temporarily disable the problematic security fix. This update includes a revised fix for CVE-2010-4818.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support.

This update temporarily disables the fix for CVE-2010-4818 that introduced the regression.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information.
(CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthieu Herrb reports :

It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file.

It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes.

ID	Name	Product	Family	Severity
80818	Oracle Solaris Third-Party Patch Update : xorg (cve_2011_4028_information_disclosure)	Nessus	Solaris Local Security Checks	low
75780	openSUSE Security Update : xorg-x11-Xvnc (openSUSE-SU-2012:0227-1)	Nessus	SuSE Local Security Checks	low
69594	Amazon Linux AMI : xorg-x11-server (ALAS-2012-104)	Nessus	Amazon Linux Local Security Checks	low
68561	Oracle Linux 6 : xorg-x11-server (ELSA-2012-0939)	Nessus	Oracle Linux Local Security Checks	low
64240	SuSE 11.1 / 11.2 Security Update : xorg-x11-server-rdp (SAT Patch Numbers 6111 / 6113)	Nessus	SuSE Local Security Checks	high
64239	SuSE 11.1 Security Update : xorg-x11-server-dmx, xorg-x11-server-dmx-debuginfo, etc (SAT Patch Number 6112)	Nessus	SuSE Local Security Checks	high
61351	Scientific Linux Security Update : xorg-x11-server on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59932	CentOS 6 : xorg-x11-server (CESA-2012:0939)	Nessus	CentOS Local Security Checks	low
59597	RHEL 6 : xorg-x11-server (RHSA-2012:0939)	Nessus	Red Hat Local Security Checks	low
57138	SuSE 11.1 Security Update : xorg-x11-server (SAT Patch Number 5479)	Nessus	SuSE Local Security Checks	low
56594	GLSA-201110-19 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	low
56580	Ubuntu 10.04 LTS / 10.10 : xorg-server vulnerability (USN-1232-3)	Nessus	Ubuntu Local Security Checks	high
56563	Ubuntu 10.04 LTS : xorg-server regression (USN-1232-2)	Nessus	Ubuntu Local Security Checks	high
56555	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : xorg-server vulnerabilities (USN-1232-1)	Nessus	Ubuntu Local Security Checks	high
56548	FreeBSD : Xorg server -- two vulnerabilities in X server lock handling code (8441957c-f9b4-11e0-a78a-bcaec565249c)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2011-4029

high

Tenable Plugins

low

low

low

low

high

high

low

low

low

low

low

high

high

high

low