xnews and XDM

[hartmans () bga com (Sam Hartman)]

   Date: Wed, 20 Jul 1994 19:52:18 -0500
   From: Sam Hartman <hartmans () bga com>
   Sender: bugtraq-owner () crimelab com
   Precedence: bulk


           AIX has a similar hole.  The DPS server can be entered by
   /usr/lpp/DPS/bin/dpsexec.  Since X runs as root, you can then open and
   write to any root owned file.

           I haven't bothered to write an exploit script, but I did try
   running /etc/security/passwd, and I got a root: UndefinedCommand
   error.

           Someone opened a bug against this inside IBM--I forget who,
   but to my knowledge, know action has been taken.

   --Sam

                I was a little too hastey when I wrote this; while it
is accurate, it is rather incomplete: naturally, it requires that DPS
be enabled for the problem to exist. 

        In fact, you could make a good argument that it is a
configuration problem, as the shipped state of DPS is disabled when
running under XDM.  Still, it's an issue to be aware of; I've seen two
or three  posts to comp.unix.aix in response to "Why doesn't DPS work
under XDM," with "Well, insert `-x DPS' into
/usr/lib/X11/xdm/Xservers.  If you have done this, consider removing
it, or disabling XDM.

--Sam