Re: CVE request for LightDM - XDMCP denial of service

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> it seems that some versions of LightDM (1.14 and 1.16 series) are vulnerable
> to a denial of service when XDMCP server is enabled. When that's the case, an
> XDMCP request with no address will crash LightDM.
>
> More information can be found in https://bugs.launchpad.net/lightdm/+bug/1516831
> and the bug is fixed with 1.14.4 and 1.16.6 (and development release
> 1.17.2).

> > it will attempt to access a negative index into an array

Use CVE-2015-8316.

The scope of this CVE is only the LightDM behavior.
https://bugs.launchpad.net/lightdm/+bug/1516831/comments/6 says "for
some reason the X server was sending Request packets with a addresses
field empty. Other Ubuntu releases are not doing this." There may be
other ongoing research into mishandling of an empty field, especially
because the "attack" is now inadvertently occurring in the wild. If
there's a related vulnerability in another independent display manager
(or if this is somehow a vulnerability in the X server) a different
CVE ID would be needed.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWUfZfAAoJEL54rhJi8gl5rHkP/A6eoozOZ/ZrSJu69aaY7GkA
ePrnoiHVcFhfoFG3laB4PU+5gMY2gSBAq6Gnydu2dhh+xMXSspuSggzgvobqHYHM
O7dl+V6EWjLC/v7ysr6qWNCsbH3AyRjcl15QjiJgaUuldVcGEhV+CGiB6l9Z0iEk
siGIyjhcOPt0Oee6PAHZGQLXRtB05LYsCKhAM/DVGXVZeitOuiwwvi2+TKAijB5u
L+r/FucKE4O/sDmqmhSVKnGfoxV9ig95djDnbEr2ULQXIc7y29Tp4W/y/9XrOo0k
PQCh2RaBFU4ZW7sb1gLPHEj09osUACuLvWL/DYPiN6w29y7tHrsORmaOL/P2MNLq
68I9SjAIKcVecEGX+hAn0owSayCZCbnebKLHEvBnRKxnch7Jv2bXj9cITC+DLLcr
EvhRJusrC/FDWM+nRjNC/aVOXtgNvzEpA1W5poAgxoEaR0eVRdLGozl8WMm1x4H6
YF2OZyy+QwgBFqk36NwuT+kH5iRXOo0RchSm5TJXzyAiismTIr73gHuw8w5aJ3Rk
1ixId5LhOSqaiLkRs94Cjl293+DwnsXtvh76wHf+GLgVK+g5x652aQZxtX7FPlRr
RoZPzXY+fOim9U377uHCZRvtPBi2Cg5y4hW9YyxeZBPjNAYivyzJB+MXZ4cMH4vw
FQAi9k2KC7DJIAWH73U6
=dB3v
-----END PGP SIGNATURE-----