From owner-freebsd-security Fri Oct 16 02:43:06 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id CAA05552 for freebsd-security-outgoing; Fri, 16 Oct 1998 02:43:06 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from aniwa.sky (aniwa.actrix.gen.nz [203.96.56.186]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id CAA05547 for ; Fri, 16 Oct 1998 02:43:03 -0700 (PDT) (envelope-from andrew@squiz.co.nz) Received: from localhost (andrew@localhost) by aniwa.sky (8.8.8/8.8.7) with SMTP id WAA06947; Fri, 16 Oct 1998 22:42:29 +1300 (NZDT) (envelope-from andrew@squiz.co.nz) Date: Fri, 16 Oct 1998 22:42:29 +1300 (NZDT) From: Andrew McNaughton X-Sender: andrew@aniwa.sky Reply-To: andrew@squiz.co.nz To: "Jan B. Koum " cc: security@FreeBSD.ORG Subject: Re: X allows ordinary user to read first line of any file In-Reply-To: <19981016022311.A753@best.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, 16 Oct 1998, Jan B. Koum wrote: > On Fri, Oct 16, 1998 at 06:08:02PM +1300, Andrew McNaughton wrote: > > > > found this on http://www.hoobie.net/security/exploits/ > > > > joeuser@host$ X -config /etc/master.passwd > > Unrecognized option: root:yd0Rj.v.r1wKA:0:0::0:0:Charlie > > use: X [:] [option] > > I am sure something will correct me, but I think you are running > the 3.3.1 version which is vulnerable I guess. It is old. You should > really upgrade. The new release doesn't even have the -config > options as far as I can tell: > > % bin/XF86_SVGA -version > [...] > XFree86 Version 3.3.2.3 / X Window System > Operating System: FreeBSD 3.0-CURRENT i386 [ELF] > [...] > % bin/XF86_SVGA -config /etc/master.passwd > bin/XF86_SVGA -config /etc/master.passwd > Unrecognized option: -config > > I am not sure if 3.0 will ship with 3.3.2.3 - Jordan? > > I myself use XiG product (hence limited knowledge of XFree86) and > that also seem fine at first glance. > > BTW, wouldn't you kind of consider this to be a bug in XFree86 rather > then a bug in FreeBSD OS? :) Yes it is 3.3.1, and yes the problem is with XFree86 rather than FreeBSD itself. Xfree86 came with my version of FreeBSD 2.2.5. Perhaps that's old enough to let it go, but this list regularly seems to cover software used by FreeBSD users outside of the operating system itself. Seemed worth a comment. What version of Xfree86 is in the latest 2.2-STABLE? Andrew To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message