SB2011112101 - Race condition in xorg-server (Alpine package)
Published: November 21, 2011
Security Bulletin ID
SB2011112101
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition (CVE-ID: CVE-2011-4029)
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=32122d96f3056f03a88facdb5acfec2debc35ce6
- https://git.alpinelinux.org/aports/commit/?id=f140d2628d9099eb107d3a8fd8903009bdf7c64c
- https://git.alpinelinux.org/aports/commit/?id=338da40764eb0d75223e726fb7f22b81120a3217
- https://git.alpinelinux.org/aports/commit/?id=35994c4a6bd181d3fffc50cb1a08813fd6d17c74