X.Org xserver Local File Permission Vulnerability Exploiting LockServer Function
CVE-2011-4029

Currently unrated

Key Information:

Vendor

X.org

Status
X Server
Vendor
CVE Published:
3 July 2012

What is CVE-2011-4029?

The LockServer function in the X.Org xserver prior to version 1.11.2 is vulnerable to a security flaw that allows local users to manipulate the permissions of arbitrary files. This vulnerability can be exploited through a symlink attack targeting a temporary lock file, enabling attackers to change file permissions to 444, thereby restricting execution and leading to a potential denial of service.

References

http://lists.freedesktop.org/archives/xorg/2011-October/0...
mailing-listx_refsource_MLIST
http://cgit.freedesktop.org/xorg/xserver/commit/?id=b6758...
x_refsource_CONFIRM
http://secunia.com/advisories/46460
third-party-advisoryx_refsource_SECUNIA

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.