X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.

In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated xorg-x11-server packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.org X11 server registered new hot plugged devices. If a local user switched to a different session and plugged in a new device, input from that device could become available in the previous session, possibly leading to information disclosure.
(CVE-2013-1940)

This issue was found by David Airlie and Peter Hutterer of Red Hat.

This update also fixes the following bugs :

* A previous upstream patch modified the Xephyr X server to be resizeable, however, it did not enable the resize functionality by default. As a consequence, X sandboxes were not resizeable on Red Hat Enterprise Linux 6.4 and later. This update enables the resize functionality by default so that X sandboxes can now be resized as expected. (BZ#915202)

* In Red Hat Enterprise Linux 6, the X Security extension (XC-SECURITY) has been disabled and replaced by X Access Control Extension (XACE). However, XACE does not yet include functionality that was previously available in XC-SECURITY. With this update, XC-SECURITY is enabled in the xorg-x11-server spec file on Red Hat Enterprise Linux 6. (BZ#957298)

* Upstream code changes to extension initialization accidentally disabled the GLX extension in Xvfb (the X virtual frame buffer), rendering headless 3D applications not functional. An upstream patch to this problem has been backported so the GLX extension is enabled again, and applications relying on this extension work as expected.
(BZ#969538)

All xorg-x11-server users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

-     U_xf86-fix-flush-input-to-work-with-Linux-evdev-device.p     atch

  - So when we VT switch back and attempt to flush the input     devices, we don't succeed because evdev won't return     part of an event, since we were only asking for 4 bytes,     we'd only get -EINVAL back. This could later cause     events to be flushed that we shouldn't have gotten. This     is a fix for CVE-2013-1940. (bnc#814653)

The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way the X.org X11 server registered new hot plugged devices. If a local user switched to a different session and plugged in a new device, input from that device could become available in the previous session, possibly leading to information disclosure.
(CVE-2013-1940)

A flaw was found in the way the X.org X11 server registered new hot plugged devices. If a local user switched to a different session and plugged in a new device, input from that device could become available in the previous session, possibly leading to information disclosure.
(CVE-2013-1940)

This update also fixes the following bugs :

  - A previous upstream patch modified the Xephyr X server     to be resizeable, however, it did not enable the resize     functionality by default. As a consequence, X sandboxes     were not resizeable on Scientific Linux 6.4 and later.
    This update enables the resize functionality by default     so that X sandboxes can now be resized as expected.

  - In Scientific Linux 6, the X Security extension     (XC-SECURITY) has been disabled and replaced by X Access     Control Extension (XACE). However, XACE does not yet     include functionality that was previously available in     XC- SECURITY. With this update, XC-SECURITY is enabled     in the xorg-x11-server spec file on Scientific Linux 6.

  - Upstream code changes to extension initialization     accidentally disabled the GLX extension in Xvfb (the X     virtual frame buffer), rendering headless 3D     applications not functional. An upstream patch to this     problem has been backported so the GLX extension is     enabled again, and applications relying on this     extension work as expected.

From Red Hat Security Advisory 2013:1620 :

Updated xorg-x11-server packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.org X11 server registered new hot plugged devices. If a local user switched to a different session and plugged in a new device, input from that device could become available in the previous session, possibly leading to information disclosure.
(CVE-2013-1940)

This issue was found by David Airlie and Peter Hutterer of Red Hat.

This update also fixes the following bugs :

* A previous upstream patch modified the Xephyr X server to be resizeable, however, it did not enable the resize functionality by default. As a consequence, X sandboxes were not resizeable on Red Hat Enterprise Linux 6.4 and later. This update enables the resize functionality by default so that X sandboxes can now be resized as expected. (BZ#915202)

* In Red Hat Enterprise Linux 6, the X Security extension (XC-SECURITY) has been disabled and replaced by X Access Control Extension (XACE). However, XACE does not yet include functionality that was previously available in XC-SECURITY. With this update, XC-SECURITY is enabled in the xorg-x11-server spec file on Red Hat Enterprise Linux 6. (BZ#957298)

* Upstream code changes to extension initialization accidentally disabled the GLX extension in Xvfb (the X virtual frame buffer), rendering headless 3D applications not functional. An upstream patch to this problem has been backported so the GLX extension is enabled again, and applications relying on this extension work as expected.
(BZ#969538)

All xorg-x11-server users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Fix input buffer size to flush evdev events before enabling a device (CVE-2013-1940) Fix scrolling on Evoluent Vertical mouse Avoid memory corruption if too many touch listeners are active Bump EQ size to avoid spurious abrt reports Add a quirk to get a reasonably sane default button mapping for the Evoluent Vertical Mouse 3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue.

This update of xorg-x11-server fixes one security issue and two bugs.

In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. (CVE-2013-1940)

Also the following bugs have been fixed :

  - A memory leak in cursor handling could slowly run the X     server out of memory. (bnc#813178)

  - A memory leak in the X GE extension has been fixed that     could have also run the X server out of memory.
    (bnc#813683)

  - A CAPS lock issue in VNC has been fixed (bnc#787170)

Fix input buffer size to flush evdev events before enabling a device (CVE-2013-1940)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New xorg-server packages are available for Slackware 13.37, 14.0, and
-current to fix a security issue.

It was discovered that the X.Org X server did not properly clear input events in certain circumstances. A local attacker with physical access could use this flaw to capture keystrokes.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Airlie and Peter Hutterer of Red Hat discovered that xorg-server, the X.Org X server was vulnerable to an information disclosure flaw related to input handling and devices hotplug.

When an X server is running but not on front (for example because of a VT switch), a newly plugged input device would still be recognized and handled by the X server, which would actually transmit input events to its clients on the background.

This could allow an attacker to recover some input events not intended for the X clients, including sensitive information.

ID	Name	Product	Family	Severity
83587	SUSE SLED10 / SLES10 Security Update : xorg-x11-server (SUSE-SU-2013:0857-1)	Nessus	SuSE Local Security Checks	low
79168	CentOS 6 : xorg-x11-server (CESA-2013:1620)	Nessus	CentOS Local Security Checks	low
74992	openSUSE Security Update : xorg-x11-server (openSUSE-SU-2013:0937-1)	Nessus	SuSE Local Security Checks	low
74028	GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
71400	Amazon Linux AMI : xorg-x11-server (ALAS-2013-260)	Nessus	Amazon Linux Local Security Checks	low
71302	Scientific Linux Security Update : xorg-x11-server on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	low
71130	Oracle Linux 6 : xorg-x11-server (ELSA-2013-1620)	Nessus	Oracle Linux Local Security Checks	low
71011	RHEL 6 : xorg-x11-server (RHSA-2013:1620)	Nessus	Red Hat Local Security Checks	low
67345	Fedora 17 : xorg-x11-server-1.12.4-7.fc17 (2013-5967)	Nessus	Fedora Local Security Checks	low
66803	SuSE 10 Security Update : xorg-x11-server (ZYPP Patch Number 8561)	Nessus	SuSE Local Security Checks	low
66801	SuSE 11.2 Security Update : Xorg (SAT Patch Number 7761)	Nessus	SuSE Local Security Checks	low
66258	Fedora 19 : xorg-x11-server-1.14.0-6.fc19 (2013-5883)	Nessus	Fedora Local Security Checks	low
66167	Fedora 18 : xorg-x11-server-1.13.3-3.fc18 (2013-5928)	Nessus	Fedora Local Security Checks	low
66158	Slackware 13.37 / 14.0 / current : xorg-server (SSA:2013-109-01)	Nessus	Slackware Local Security Checks	low
66022	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : xorg-server, xorg-server-lts-quantal vulnerability (USN-1803-1)	Nessus	Ubuntu Local Security Checks	low
66004	Debian DSA-2661-1 : xorg-server - information disclosure	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2013-1940

high

Tenable Plugins

low

low

low

medium

low

low

low

low

low

low

low

low

low

low

low

low