Description
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.
References
- VU#911505 third-party-advisory
- 55760 vendor-advisory
- CLA-2003:693 vendor-advisory
- 20021214 BDT_AV200212140001: Insecure default: Using pam_xauth for su from sh-utils package mailing-list
- linux-pamxauth-gain-privileges(11254) vdb-entry
- RHSA-2003:035 vendor-advisory
- RHSA-2003:028 vendor-advisory
- 6753 vdb-entry
- MDKSA-2003:017 vendor-advisory