CVE-2000-1060: Medium severity Xfree86 Project Xfce vulnerability

Published Dec 11, 2000

Updated

The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffic and gain privileges.

Affected Software

1 affected component

Xfree86 Project Xfce=3.5.1

Remediation

Patch Available

http://www.securityfocus.com/bid/1736

Event History

Dec 11, 2000

CVE Published

05:00 AM

Jan 22, 2001

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-1060?

CVE-2000-1060 is considered to have a moderate severity level due to the potential for local users to sniff X Windows traffic.

How do I fix CVE-2000-1060?

To fix CVE-2000-1060, modify the default xinitrc configuration to remove the 'xhost + localhost' command.

Who is affected by CVE-2000-1060?

CVE-2000-1060 affects users running XFCE 3.5.1 with the default configuration.

What are the implications of exploiting CVE-2000-1060?

Exploiting CVE-2000-1060 allows local users to sniff X Windows traffic, potentially gaining access to sensitive information.

Is CVE-2000-1060 still a concern in modern systems?

While CVE-2000-1060 is an older vulnerability, it is still a concern for systems that operate the affected XFCE version without security updates.