CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2004-08-18

Last modified

2024-08-08

Affected products

• Linux (Gentoo)
• X11r6 (X.org)
• Xdm (Xfree86 Project)

References

• http://bugs.xfree86.org/show_bug.cgi?id=1376
• http://secunia.com/advisories/12019
• http://securitytracker.com/id?1010306
• http://www.ciac.org/ciac/bulletins/p-001.shtml
• http://www.gentoo.org/security/en/glsa/glsa-200407-05.xml
• http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:073
• http://www.openbsd.org/errata.html#xdm
• http://www.redhat.com/support/errata/RHSA-2004-478.html
• http://www.securityfocus.com/bid/10423
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16264
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10161