> i copy paste the wrong lines. if logged in on the console > i get a segfault. using ssh i get: > > [EMAIL PROTECTED] evert]$ X :0 -fp $PWD > Authentication failed - cannot start X server. > Perhaps you do not have console ownership? > [EMAIL PROTECTED] evert]$ > > so my real question was... is it still remotely (using a php > include with apache or something) to exploit the bug?
For clarification: This is about fonts.dir and fonts.alias files that the X server reads if told so. The commandline is only an academic example. Place the two fonts.* files somewhere and use the "xset +fp somewhere" command to make the X server read them. For that, you need access to the Xserver using the configured access control mechanisms, usually xauth/cookies. The hurdle of the X Display access control makes the vulnerability a local vulnerability, regardless if the attack vector involves a network connection (X11 on port 6000 and maybe font-service on port 7100, also an option for placing fonts.*). An attack would target the privileges used by the X server: Usually root, by setuid-root or by xdm/kdm/gdm/wdm display managers/graphical logins. > kind regards, > Evert rgds, Roman. -- - - | Roman Drahtm�ller <[EMAIL PROTECTED]> // "You don't need eyes to see, | SUSE Linux AG - Security Phone: // you need vision!" | N�rnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
