X.Org多个setuid调用返回检查本地权限提升漏洞

X.Org是X.Org Foundation对X窗口系统的开源实现。 X.Org在处理权限放弃操作时存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 X.Org没有检查setuid()或类似的调用是否成功。如果由于“maximum processes”ulimit的限制导致调用失败的话，就会导致进程以root用户权限执行某些特权操作（文件访问）。 X.org X.org 6.7.0 - 7.1 Gentoo已经为此发布了一个安全公告（GLSA-200608-25）以及相应补丁: GLSA-200608-25：X.org and some X.org libraries: Local privilege escalations 链接：http://security.gentoo.org/glsa/glsa-200608-25.xml X.org ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： X.Org 6.8.2 http://www.freedesktop.org/releases/X11R6.8.2/patches/ MD5 (xorg-68x-setuid.patch) = 0ce4435659d13cb75e409e92639f22eb SHA1 (xorg-68x-setuid.patch) = d00815d19152da84de6677fcae04e6d96ee5db70 X.Org 6.9.0 http://www.freedesktop.org/releases/X11R6.9.0/patches/ MD5 (x11r6.9.0-setuid.diff) = 8e95fc06109d44ac280431d9cd8b41c9 SHA1 (x11r6.9.0-setuid.diff) = e576d725dd5f8d6c70df4b024adeecc5f7f90dc6 X.Org 7.0 http://www.freedesktop.org/releases/X11R7.0/patches/ MD5 (x11r7.0-setuid.diff) = a336e7e01a0876ec182c90277ab3e6fe SHA1 (x11r7.0-setuid.diff) = 16a6a1c4a3527390caf53a45f4718ef378c90c14 X.Org 7.1 http://www.freedesktop.org/releases/X11R7.1/patches/ MD5 (libX11-1.0.1-setuid.diff) = 4b14554b64e4a8b1ec3c2b85cb5199b6 SHA1 (libX11-1.0.1-setuid.diff) = 6e2b6a43d394a474b8b731abb8d811625845421c MD5 (xtrans-1.0.0-setuid.diff) = a3704e53fae7249379d842f6e626423a SHA1 (xtrans-1.0.0-setuid.diff) = 82b913fe5ec96fd55afb8356ae338b90ed0f179b MD5 (xorg-xserver-1.1.0-setuid.diff) = bd7f9871a9142197b8f45ad09969c6c5 SHA1 (xorg-xserver-1.1.0-setuid.diff) = e72b50c6434d429abaf0c13d9e78e1d467579fe9 MD5 (xdm-1.0.4-setuid.diff) = 24d467822a4dbf2f536ee419e0322f2d SHA1 (xdm-1.0.4-setuid.diff) = 5b33a136ceffd40230fb65bf3cc635f8fc84e279 MD5 (xf86dga-1.0.1-setuid.diff) = 2a07eebe5796a86f307f9c1a3d0a2fa0 SHA1 (xf86dga-1.0.1-setuid.diff) = 4f184e186b280792878ec9118181067de7339f96 MD5 (xinit-1.0.2-setuid.diff) = 1377016ad0dd0e127419e4452d66a8ef SHA1 (xinit-1.0.2-setuid.diff) = 816fa2fea8dbc1479ed594dace6281538de5e0ad MD5 (xload-1.0.1-setuid.diff) = 9813ecc6d82157d1e5d19cf265af6ff9 SHA1 (xload-1.0.1-setuid.diff) = b14a6f911c2043052aa5006f3146fc5534705c2f