Executive brief
A vulnerability in the X Window System, a graphical interface used on Unix and Linux systems, allows remote attackers to gain unauthorized access to a user's session. By guessing the security tokens (magic cookies) used to authenticate connections, an attacker can remotely execute commands on the victim's machine. This could lead to a complete system takeover, theft of sensitive data, or the installation of malicious software.
Technical details
The X Window System (X11) uses a cookie-based authentication mechanism (MIT-MAGIC-COOKIE-1) to control access to the X server. This vulnerability arises because the 'magic cookies' generated are sufficiently predictable or have low entropy, making them susceptible to brute-force or guessing attacks. A remote attacker who successfully guesses a valid cookie can connect to the X server and interact with the session. This allows for various attacks, including capturing keystrokes, viewing the screen, or injecting commands into terminal emulators like xterm to achieve remote code execution. This issue is historically significant in early Unix environments and SunOS/Solaris configurations.
Affected products
- X.Org X Window System (X11)
- Sun Microsystems Solaris 2.6
- Sun Microsystems SunOS
Timeline
- 1995-11-01: disclosed: Initial publication date in NVD