[29221] in bugtraq
Re: xscreensaver exploit for Redhat 7.3
daemon@ATHENA.MIT.EDU (Steven Leikeim)
Fri Mar 7 12:36:35 2003
Date: Thu, 6 Mar 2003 14:56:27 -0700
From: Steven Leikeim <steven@enel.ucalgary.ca>
To: bugtraq@securityfocus.com
Message-ID: <20030306145627.B16036@enel.ucalgary.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030306182641.394.qmail@www.securityfocus.com>; from guilecool@usa.com on Thu, Mar 06, 2003 at 06:26:41PM -0000
On Thu, Mar 06, 2003 at 06:26:41PM -0000, Angelo Rosiello wrote:
>
> I think you don't need other comments:
>
> /*
> **
> ** Tested on rh 7.3 using XFree86
> ** xscreensaver vulnerability
> ** AUTHORS: Angelo Rosiello (Guilecool) & deka
> ** REQUIRES: X must be run!
> ** EFFECTS: local root exploit!
> **
Oddly enough, this does NOT work on my RedHat 7.3 installation. I have the
default xscreensaver RPM installed (xscreensaver-3.33-4).
When I run this, xscreensaver DOES dump core, however, xscreensaver is not
suid root and so will not itself give a root exploit. Perhaps there is an
expected interaction with the X server (which is running as root) but this
is not clear from Angelo's message.
Steven Leikeim
Department of Electrical and Computer Engineering
University of Calgary
