CVE-2006-0745 Privilege escalation in n/a
Local attackers can execute arbitrary code or overwrite files by exploiting a logic error in X.Org server's geteuid handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-0745?
CVE-2006-0745 is a high-severity vulnerability in Mandrakesoft Mandrake Linux, published on 21 Mar 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
Which versions are affected by CVE-2006-0745?
It affects 6 products.
Products include Mandrakesoft Mandrake Linux, Redhat Fedora Core, Sun Solaris, Suse Suse Linux, X.org X11r6, X.org X11r7.
How do I fix CVE-2006-0745?
Apply the vendor's patch.
Is CVE-2006-0745 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-0745 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mandrakesoft Mandrake Linux
Sources
Also known as DEBIAN-CVE-2006-0745, GHSA-qhrh-3jj7-5jgg.