Re: Is FreeBSD susceptible to this vulnerability?

From: David Pick (d.m.pick@qmul.ac.uk)
Date: 03/28/02 

To: Brett Glass <brett@lariat.org>
Date: Thu, 28 Mar 2002 14:58:11 +0000
From: David Pick <d.m.pick@qmul.ac.uk>

> Apparently, several UNIX-like operating systems can be penetrated via
> XDMCP/UDP; see
>
> http://www.procheckup.com/security_info/vuln_pr0208.html
>
> Is FreeBSD vulnerable? What about the other BSDs?

(All the following is from reading the notice and having used
XDM myself in the past; not from reading the code...)

The notice says it's an "information leakage" vulnerability that
can leak information useful for otherwise unrelated brute-force
attacks.

It's also more a matter of the default configurations for the
XMDCP daemon rather than the code of the daemon.

The FreeBSD default configuratin *is* vulnerable but doesn't
gratuitously leak information (for example by providing lists
of valid users). So it's no more or less vulnerable than having
an open listening "telnet" service. Or an open "finger" service.
However, the notice is worthwhile because it points out that
such leakage can happen via services that use UDP as well as
services using TCP. 

-- 
	David Pick
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages