Vulnerability CVE-2006-5215 - CERT Civis.Net

Vulnerability Name:

CVE-2006-5215 (CCN-29427)

Assigned:

2006-10-06

Published:

2006-10-06

Updated:

2018-10-30

Summary:

The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.
This vulnerability is addressed in the following product updates:
X.org, xdm, 2006-03-17
NetBSD, NetBSD, Current 2006-02-12
Sun, Solaris, 10 2006-10-06

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

2.6 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N)
2.3 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
2.3 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

File Manipulation

References:

Source: MITRE
Type: CNA
CVE-2006-5215

Source: CCN
Type: NetBSD CVS Repository
NetBSD CVS Repository

Source: CCN
Type: SA22992
Avaya CMS Sun Solaris X Display Manager Security Issue

Source: SECUNIA
Type: UNKNOWN
22992

Source: CCN
Type: SECTRACK ID: 1017015
Xdm May Let Local Users View the Error Log Files of a Target User

Source: SECTRACK
Type: UNKNOWN
1017015

Source: CCN
Type: Sun Alert ID: 102652
Security Vulnerability in X Display Manager (xdm(1)) Xsession Script

Source: SUNALERT
Type: UNKNOWN
102652

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm

Source: CCN
Type: ASA-2006-250
Sun Alert Notifications from Sun Weekly Report dated October 07 2006

Source: CONFIRM
Type: UNKNOWN
http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=32805

Source: CCN
Type: OSVDB ID: 29579
Multiple Vendor X Display Manager Xsession Script Symlink Arbitrary File Overwrite

Source: CCN
Type: X.Org Foundation Web site
X.Org Foundation

Source: CONFIRM
Type: UNKNOWN
https://bugs.freedesktop.org/show_bug.cgi?id=5898

Source: XF
Type: UNKNOWN
xdm-xsession-symlink(29427)

Source: XF
Type: UNKNOWN
xdm-xsession-symlink(29427)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:2205

Vulnerable Configuration:

Configuration 1:

cpe:/a:x.org:xdm:*:*:*:*:*:*:*:* (Version <= 1.0.3)

Configuration 2:

cpe:/o:netbsd:netbsd:1.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.2.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.3:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.3.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.3.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.3.3:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4:*:alpha:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4:*:arm32:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4:*:sparc:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4:*:x86:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:alpha:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:arm32:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:sh3:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:sparc:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.1:*:x86:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.2:*:alpha:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.2:*:arm32:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.2:*:sparc:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.2:*:x86:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.4.3:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5:*:sh3:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5:*:x86:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5.3:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.6:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.6:beta:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.6.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.6.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:2.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:2.0.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:2.0.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:2.0.3:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:2.1:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:3.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:3.99.15:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:4.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:*:*:*:*:*:*:*:* (Version <= current)

OR cpe:/o:sun:solaris:8.0:*:sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:8.0:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:8.0:beta:*:*:*:*:*:*

OR cpe:/o:sun:solaris:9.0:*:sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:9.0:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:*

OR cpe:/o:sun:solaris:10.0:*:sparc:*:*:*:*:*

OR cpe:/o:sun:sunos:5.8:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.9:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:2205	V	Security Vulnerability in X Display Manager (xdm(1)) Xsession Script	2007-09-27