Explain CVE-2008-1483
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
Affected Products: n/a
References: [{'name': 'ADV-2008-1123', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1123/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.attachmate.com/techdocs/2374.html'}, {'name': 'DSA-1576', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1576'}, {'name': '29554', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29554'}, {'name': 'ADV-2008-1526', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1526/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2008-205.htm'}, {'name': 'ADV-2008-1630', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1630/references'}, {'name': '[security-announce] 20080403 Globus Security Advisory 2008-01: GSI-OpenSSH vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.globus.org/mail_archive/security-announce/2008/04/msg00000.html'}, {'name': '29686', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29686'}, {'name': 'APPLE-SA-2008-09-15', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html'}, {'name': '31531', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31531'}, {'name': 'SSA:2008-095-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.540188'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc'}, {'name': 'HPSBUX02337', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01462841'}, {'name': 'openssh-sshd-session-hijacking(41438)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41438'}, {'name': 'USN-597-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/597-1/'}, {'name': '1019235', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019235.1-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463011'}, {'name': 'TA08-260A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-260A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2397'}, {'name': 'ADV-2008-1624', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1624/references'}, {'name': 'ADV-2008-2584', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2584'}, {'name': '30249', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30249'}, {'name': '20130220 OpenSSH Forwarded X Connection Session Hijack Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2008-1483'}, {'name': '29735', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29735'}, {'name': '29683', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29683'}, {'name': '30361', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30361'}, {'name': '31882', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31882'}, {'name': 'SUSE-SR:2008:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html'}, {'name': 'SSRT080072', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01462841'}, {'name': '29721', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29721'}, {'name': 'ADV-2008-2396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2396'}, {'name': '29522', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29522'}, {'name': '30086', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30086'}, {'name': '29939', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29939'}, {'name': '30347', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30347'}, {'name': 'oval:org.mitre.oval:def:6085', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6085'}, {'name': 'ADV-2008-0994', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0994/references'}, {'name': '1019707', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019707'}, {'name': '237444', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-237444-1'}, {'name': 'MDVSA-2008:078', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:078'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=590180&group_id=69227'}, {'name': '29676', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29676'}, {'name': '29873', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29873'}, {'name': '29537', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29537'}, {'name': '29626', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29626'}, {'name': '20080325 rPSA-2008-0120-1 gnome-ssh-askpass openssh openssh-client openssh-server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490054/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0120'}, {'name': 'ADV-2008-1448', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1448/references'}, {'name': 'NetBSD-SA2008-005', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc'}, {'name': '30230', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30230'}, {'name': '28444', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28444'}, {'name': 'GLSA-200804-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200804-03.xml'}, {'name': 'FreeBSD-SA-08:05', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'http://security.FreeBSD.org/advisories/FreeBSD-SA-08:05.openssh.asc'}, {'name': 'ADV-2008-1124', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1124/references'}]
CVE State: PUBLISHED