GLSA-200407-05 : XFree86, XDM ignores requestPort setting

This script is Copyright (C) 2004-2015 Tenable Network Security, Inc.

Synopsis :

The remote Gentoo host is missing one or more security-related

Description :

The remote host is affected by the vulnerability described in GLSA-200407-05
(XFree86, XDM ignores requestPort setting)

XDM will open TCP sockets for its chooser, even if the
DisplayManager.requestPort setting is set to 0. Remote clients can use this
port to connect to XDM and request a login window, thus allowing access to
the system.

Impact :

Authorized users may be able to login remotely to a machine running XDM,
even if this option is disabled in XDM's configuration. Please note that an
attacker must have a preexisting account on the machine in order to exploit
this vulnerability.

Workaround :

There is no known workaround at this time. All users should upgrade to the
latest available version of X.

See also :

Solution :

If you are using XFree86, you should run the following:
# emerge sync
# emerge -pv '>=x11-base/xfree-4.3.0-r6'
# emerge '>=x11-base/xfree-4.3.0-r6'
If you are using's X11 server, you should run the following:
# emerge sync
# emerge -pv '>=x11-base/xorg-x11-6.7.0-r1'
# emerge '>=x11-base/xorg-x11-6.7.0-r1'

Risk factor :

High / CVSS Base Score : 7.5

Family: Gentoo Local Security Checks

Nessus Plugin ID: 14538 (gentoo_GLSA-200407-05.nasl)

Bugtraq ID:

CVE ID: CVE-2004-0419

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now