Other versions as well. The XFree86 servers let you specify an alternate configuration file and do not check whether you have rights to read it.
Any user can read files with root permissions.
If you run xdm, you should consider removing the setuid bit of the servers. If not, well, wait for the XFree86 Project to bring you a patch, since I'm too lazy to find and fix it. I agree with the recomendation of removing the setuid bit and using xdm to start the Xserver, and if you have XFree86 on a machine where this problem is significant, you should consider doing this. The fix is to disable the '-config' Xserver option. This will be removed in our next release, and also in the next X11 release from The Open Group.