Re: LXDM X authentication issues

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> LXDM before 0.5.2 did not start X server with -auth parameter.
> Therefore any user able to connect to it (typically all local users)
> would have their X connections accepted.  The issue was fixed via:
>
> http://git.lxde.org/gitweb/?p=lxde/lxdm.git;a=commit;h=e8f387089e241360bdc6955d3e479450722dcea3

> > pass xauth file to xserver command

It appears that this is the major finding. Use CVE-2015-8308.


> LXDM also defaults to not restarting X server between sessions, and
> does not change authentication cookies or remove xhost authorizations.
> This allows local user to be able to connect to the X server after they
> logged out. The 'reset' option in lxdm.conf controls whether X server
> is restarted on session user close.

This possibly can be included in CVE but, if so, the CVE ID would be
different. Is there any other information, e.g., why was there a
decision to make reset an optional behavior rather than a required
behavior? Is there a possible attack by a different local user, or is
the relevant attack that someone could steal the computer and recover
the authentication cookies (possibly violating an expectation of the
legitimate user who believed they were safely logged out)? Is the
behavior different from all major display managers?
http://wiki.lxde.org/en/LXDM says "LXDM is the lightweight display
manager ..." -- is the design tradeoff possibly different on a
low-resource machine where it's very expensive to restart the X server?

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWT2WBAAoJEL54rhJi8gl50F8QAIGlLgPJfDdmpJy6jGd32eEd
S20uQCZUpZY9OADmAm5TNJsXCuCxoypnPb6/RDNymiTl+Z22qtmwiXDQqMFWD5EN
nwxJfVJHM2eWEpCo0ZF8Ocn7yZm/MQKGbPEMqKIXe3TjOEAn92is4bzOq2DFCRe3
g9aKxKCOG0B6zv8T7z3pO/BF9HvkFskmEopMA6DCDCQVJjZ0eE7p/oF9U/XCoG1v
4TQVsuPl2ojAYmowZ4kFGgMnWcA5QKL3bwlddCWVbaEFpj59uznWvcFpfzc7WEnW
WVPFyqeTMaIsCC8APVRNXvKfi6xKxngofA5V0lFGOMvltCEIyJVOP1quHJuyyEMh
7B3246JT0Gt7Z2rlKpfRuTIM5sas0GWdODCtVhE6+h2Ym2gcKmdnspgfBEsqoSAJ
IgqVoO1Hhjv0ozoNOgcgw+JyBLS7yus6jHWrhzlCeKGN0RXpEQlrEzHLTGKJq7K3
sd8sTwFFntIfpDDwUqeC+8JUhaLB7AGzVYJtfPeHRQAI5OxGSRxhVd51bDREfRtl
BVVSVb9lYV81NQkAqHluT6MIHQWGGXdo/DocpbJsRUiWYqSUVXTLk3VcUnKRPtYY
3pZHzWjzuU+/jSg123onftMond/HBqYEC9pRICbRQScv7QE/eOSuUHzP5FovW30N
71swFR6kDua+AGm6F6rY
=59AY
-----END PGP SIGNATURE-----