Re: CERT* VB-98.04: Vulnerabilities in xterm and Xaw

1998-04-28 Thread Thomas Roessler
On Tue, Apr 28, 1998 at 12:45:33PM -0500, Branden Robinson wrote: > Well, the reason xterm is setuid is because it needs > privileged access to the utmp file. However, this is > presently a problem under some circumstances (see bug > #20685). It's not the only reason: XTerm needs to be suid root

Re: CERT* VB-98.04: Vulnerabilities in xterm and Xaw

1998-04-28 Thread Mark Baker
On Tue, Apr 28, 1998 at 12:45:33PM -0500, Branden Robinson wrote: > Well, the reason xterm is setuid is because it needs privileged access to > the utmp file. However, this is presently a problem under some > circumstances (see bug #20685). I understand it also needs it to allocate a pty. > XFr

Re: CERT* VB-98.04: Vulnerabilities in xterm and Xaw

1998-04-28 Thread Branden Robinson
On Tue, Apr 28, 1998 at 05:12:22PM +0100, Mark Baker wrote: > On Tue, Apr 28, 1998 at 05:57:55PM +0200, A Mennucc wrote: > > > > Vulnerabilities exist in the terminal emulator xterm(1), and the Xaw > > > library distributed in various MIT X Consortium; X Consortium, Inc.; > > > and The Open Group

Re: CERT* VB-98.04: Vulnerabilities in xterm and Xaw

1998-04-28 Thread Mark Baker
On Tue, Apr 28, 1998 at 05:57:55PM +0200, A Mennucc wrote: > > Vulnerabilities exist in the terminal emulator xterm(1), and the Xaw > > library distributed in various MIT X Consortium; X Consortium, Inc.; > > and The Open Group X Project Team releases. These vulnerabilities may > > be exploited by

CERT* VB-98.04: Vulnerabilities in xterm and Xaw

1998-04-28 Thread A Mennucc
Hi Are we aware of (concerned by) ftp://ftp.cert.org/pub/cert_bulletins/VB-98.04.xterm.Xaw ? it says that > Vulnerabilities exist in the terminal emulator xterm(1), and the Xaw > library distributed in various MIT X Consortium; X Consortium, Inc.; > and The Open Group X Project Team release