Massive Number of Vulnerabilities Found in X.Org

Re:Massive Number of Vulnerabilities Found in X.Org by EvilLook on Thursday May 23, 2013 @02:48PM (#5758656)

These seem like such basic errors. Not validating responses because you trust the software you interact with to behave is such a basic mistake that you'd think the people that work on the X server from X.Org would have learned not to do that long ago.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by jerf on Thursday May 23, 2013 @03:03PM (#5758754)

It sounds like these errors predate X.Org qua X.Org. A lot of people have had some responsibility for this code at some point without noticing this.

Bear in mind X11 is pretty old, and these are some of the oldest libraries in the whole X constellation. That isn't an "excuse", but it's a reason.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by anonymouz on Thursday May 23, 2013 @03:05PM (#5758771)

And when the stuff was originally written, this was probably not considered to be a "security boundary" in the sense that the client will have higher privileges than the server. As the email notes, this happens rather rarely.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by lawnchair_larry on Thursday May 23, 2013 @03:55PM (#5759129)

Actually it was more common back then. Remember, "client" and "server" are backwards in the context of X. A "thin client" actually runs an X Server, and you remotely launch an xterm on the central server as an "x client", exported to your display.

However, as the email states, this only gets you the same access your user already had on the remote system, unless it's a setuid program. The canonical example and only one I can think of off the top of my head is xscreensaver or xlock. There are now GUI versions of su/sudo that would also be targets, but I don't think variants of these were used back when this topology was common.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by mprovost on Friday May 24, 2013 @03:43AM (#5761655)

This is a good read about how jwz coded xscreensaver to be secure and the pitfalls of using GUI toolkits:

http://www.jwz.org/xscreensaver/toolkits.html

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by mikeash on Thursday May 23, 2013 @03:46PM (#5759072)

I'd wager that many of these errors predate many of the commenters on this site. X is pretty old.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by MostAwesomeDude on Thursday May 23, 2013 @05:42PM (#5759707)

I was an X.org hacker a few years ago. X predates me.

X is (very) roughly the size of GCC. It's massive and it's nearly entirely C, with a few modern Python scripts to generate some of the more onerous tables. There are many old libraries, and they are horrifying. Eldritch, cyclopean, etc.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by rjsw on Thursday May 23, 2013 @08:26PM (#5760480)

A lot of the libraries listed are relatively new though.

[ Parent | on HN ]

Re:Massive Number of Vulnerabilities Found in X.Org by jevinskie on Friday May 24, 2013 @12:03AM (#5761224)

An macros to rival, but not beat (they can't be!!!) Perl's!

[ Parent | on HN ]