A weakness and a security issue have been reported in X.Org xserver, which can be exploited by malicious, local users to disclose system and sensitive information and cause a DoS (Denial of Service).

1) The weakness is caused due to the "LockServer()" function (os/utils.c) behaving differently when trying to create the lock file and the lock file already exists as a symlink, depending on whether or not the symlink points to an existing or non-existing file.

2) The security issue is caused due to a race condition within the "LockServer()" function (os/utils.c) when setting the permissions of the lock file, which can be exploited to change the permissions of arbitrary files to mode 444 via symlink attacks.

Solution
Update to xserver version 1.11.3.

Provided and/or discovered by
The vendor credits vladz.

Changelog
Further details available in Customer Area

Original Advisory
http://lists.freedesktop.org/archives/xorg/2011-October/053680.html
http://cgit.freedesktop.org/xorg/xserver/commit/?id=6ba44b91e37622ef8c146d8f2ac92d708a18ed34
http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4

Deep Links
Links available in Customer Area