CVE

Id
5547  
CVE No.
CVE-2002-1160  
Status
Entry  
Description
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user"s credentials after root uses su.  
Phase
 
Votes
 
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
30202 5547 CVE-2002-1160 BUGTRAQ:20021214 BDT_AV200212140001: Insecure default: Using pam_xauth for su from sh-utils package  View
30203 5547 CVE-2002-1160 URL:http://marc.info/?l=bugtraq&m=104431622818954&w=2  View
30204 5547 CVE-2002-1160 CONECTIVA:CLA-2003:693  View
30205 5547 CVE-2002-1160 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000693  View
30206 5547 CVE-2002-1160 MANDRAKE:MDKSA-2003:017  View
30207 5547 CVE-2002-1160 URL:http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:017  View
30208 5547 CVE-2002-1160 REDHAT:RHSA-2003:028  View
30209 5547 CVE-2002-1160 URL:http://www.redhat.com/support/errata/RHSA-2003-028.html  View
30210 5547 CVE-2002-1160 REDHAT:RHSA-2003:035  View
30211 5547 CVE-2002-1160 URL:http://www.redhat.com/support/errata/RHSA-2003-035.html  View
30212 5547 CVE-2002-1160 SUNALERT:55760  View
30213 5547 CVE-2002-1160 URL:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55760  View
30214 5547 CVE-2002-1160 CERT-VN:VU#911505  View
30215 5547 CVE-2002-1160 URL:http://www.kb.cert.org/vuls/id/911505  View
30216 5547 CVE-2002-1160 BID:6753  View
30217 5547 CVE-2002-1160 URL:http://www.securityfocus.com/bid/6753  View
30218 5547 CVE-2002-1160 XF:linux-pamxauth-gain-privileges(11254)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63308 JVNDB-2003-000034 Red Hat Linux の pam_xauth における権限を不正に昇格される脆弱性 Red Hat Linux に含まれる pam_xauth モジュールには、X セッションで使用される root ユーザの認証用 Cookie の取り扱いに不備が存在し、root ユーザによって実行中の X セッションへのアクセスが可能となる脆弱性が存在します。 CVE-2002-1160 5547 7.2 http://jvndb.jvn.jp/ja/contents/2003/JVNDB-2003-000034.html  View