Vulnerability Details : CVE-2004-0419

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
Publish Date : 2004-08-18 Last Update Date : 2017-10-10

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	7.5
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact	Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	User
Vulnerability Type(s)
CWE ID	CWE id is not defined for this vulnerability

- Additional Vendor Supplied Data

Vendor	Impact	CVSS Score	CVSS Vector	Report Date	Publish Date
Redhat	moderate				2004-05-19

If you are a vendor and you have additional data which can be automatically imported into our database, please contact admin @ cvedetails.com

- Related OVAL Definitions

Title	Definition Id	Family
RHSA-2004:478: XFree86 security update (Moderate)	oval:com.redhat.rhsa:def:20040478	unix
RHSA-2004:478: XFree86 security update (Moderate)	oval:com.redhat.rhsa:def:2004478	unix
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attacker...	oval:org.mitre.oval:def:10161	unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2004-0419

#	Product Type	Vendor	Product	Version
1	OS	Gentoo	Linux	1.4	Version Details Vulnerabilities
2	Application	X.org	X11r6	6.7.0	Version Details Vulnerabilities
3	Application	Xfree86 Project	XDM	CVS	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Gentoo	Linux	1
X.org	X11r6	1
Xfree86 Project	XDM	1

- References For CVE-2004-0419

http://bugs.xfree86.org/show_bug.cgi?id=1376 CONFIRM

https://exchange.xforce.ibmcloud.com/vulnerabilities/16264
XF xdm-socket-gain-access(16264)

http://www.openbsd.org/errata.html#xdm
OPENBSD 20040526 008: SECURITY FIX: May 26, 2004

http://www.redhat.com/support/errata/RHSA-2004-478.html
REDHAT RHSA-2004:478

http://www.gentoo.org/security/en/glsa/glsa-200407-05.xml
GENTOO GLSA-200407-05

http://www.securityfocus.com/bid/10423
BID 10423 XFree86 XDM RequestPort Random Open TCP Socket Vulnerability Release Date:2009-07-12

http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:073
MANDRAKE MDKSA-2004:073

http://www.ciac.org/ciac/bulletins/p-001.shtml
CIAC P-001

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900 CONFIRM

http://securitytracker.com/id?1010306
SECTRACK 1010306

- Metasploit Modules Related To CVE-2004-0419

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)