Debian Security Advisory
XFree86 -- symbolic link can be used to make any file world readable
- Date Reported:
- 31 Mar 1999
- Affected Packages:
- none
- Vulnerable:
- No
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 326.
In Mitre's CVE dictionary: CVE-1999-0433. - More information:
- Some versions of the X windowing system will make
/tmp/.X11-unix world readable, even if that location is a symbolic
link to
another file on the system. Debian 2.1 (slink) is not affected by this
problem.
It appears that the bug was originally reported for a NetBSD system on Packetstorm - March 1999 exploits, the page has a reference showing that Linux is also vulnerable. Additionally, SUSE Security Announcement for this vulnerability is available on this BugTraq list - 1999 Mar (0216) page.