CVE-2000-0491: Buffer Overflow

Published May 24, 2000

Updated

Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARDQUERY request.

Affected Software

4 affected components

Gnome gdm=1.0

Caldera OpenLinux

SUSE SuSE Linux=6.2

SUSE SuSE Linux=6.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove GNOME gdm from your environment.
Uninstall gdm if remote graphical login/display manager functionality is not required.
Remove
Remove KDE kdm from your environment.
Uninstall kdm if remote graphical login/display manager functionality is not required.
Remove
Remove wdm from your environment.
Uninstall wdm if remote graphical login/display manager functionality is not required.
Configuration
Disable XDMCP/remote X11 login support in gdm to prevent processing of FORWARD_QUERY requests.
GNOME gdm XDMCP (FORWARD_QUERY) handling = disabled
Configuration
Disable XDMCP/remote X11 login support in kdm to prevent processing of FORWARD_QUERY requests.
KDE kdm XDMCP (FORWARD_QUERY) handling = disabled
Configuration
Disable XDMCP/remote X11 login support in wdm to prevent processing of FORWARD_QUERY requests.
wdm XDMCP (FORWARD_QUERY) handling = disabled
Compensating control
Block or filter XDMCP traffic (UDP port 177) at network perimeter devices and restrict access to display manager services to trusted hosts/networks.

Event History

May 24, 2000

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Jul 12, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0491?

CVE-2000-0491 is classified as a high severity vulnerability due to the potential for remote command execution and denial of service.

How do I fix CVE-2000-0491?

To fix CVE-2000-0491, update the affected software packages to their latest versions that contain the patched XDMCP parsing code.

Which software is affected by CVE-2000-0491?

CVE-2000-0491 affects GNOME gdm 1.0, SUSE Linux versions 6.2 and 6.4, as well as SCO OpenLinux Server.

Can CVE-2000-0491 be exploited remotely?

Yes, CVE-2000-0491 can be exploited remotely through a long FORWARD_QUERY request to the vulnerable software.

What are the consequences of CVE-2000-0491 exploitation?

Exploitation of CVE-2000-0491 can lead to arbitrary command execution or a denial of service on the affected systems.