CVE-2000-0374 in Solaris
Summary
by MITRE
The default configuration of kdm in Caldera and Mandrake Linux, and possibly other distributions, allows XDMCP connections from any host, which allows remote attackers to obtain sensitive information or bypass additional access restrictions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability described in CVE-2000-0374 represents a critical security flaw in the default configuration of the KDE Display Manager (kdm) found in Caldera and Mandrake Linux distributions, with potential impacts extending to other Linux systems. This issue stems from the improper default settings that permit XDMCP (X Display Manager Control Protocol) connections from any host without adequate authentication or access controls. The XDMCP protocol is designed to allow remote users to connect to X Window System displays, but when configured improperly, it creates significant security risks that can be exploited by malicious actors.
The technical flaw lies in the default configuration of kdm which fails to implement proper network access controls for XDMCP connections. XDMCP operates on UDP port 177 and TCP port 177, and when these services are left open to all hosts, attackers can establish connections to the display manager without proper authentication. This configuration essentially removes the network boundary protection that should exist between the display manager and remote clients, allowing any remote host to potentially connect and interact with the X session. The vulnerability specifically affects systems where kdm is configured to accept XDMCP connections from any IP address, creating an attack surface that can be exploited for unauthorized access.
The operational impact of this vulnerability extends beyond simple unauthorized access to include potential information disclosure and privilege escalation scenarios. Remote attackers can leverage this weakness to gain access to graphical user interfaces without proper authentication, potentially allowing them to observe sensitive information displayed on the screen, interact with running applications, or even bypass additional access controls that might be present at the application level. This represents a fundamental failure in the principle of least privilege, where default configurations should never expose system services to unauthenticated access from external networks. The vulnerability particularly affects systems where the display manager is running on network-accessible hosts, making it a significant concern for enterprise environments where security boundaries are critical.
This vulnerability aligns with CWE-284, which addresses improper access control, and represents a classic example of insecure default configurations that violate fundamental security principles. The issue also relates to ATT&CK technique T1078 which covers valid accounts and privilege escalation through unauthorized access to systems. Organizations affected by this vulnerability should immediately implement network segmentation to restrict access to XDMCP ports, configure proper access controls in kdm, and disable XDMCP functionality if it is not required for legitimate business operations. The recommended mitigations include configuring kdm to only accept connections from trusted IP addresses, implementing firewall rules to block XDMCP traffic, and ensuring that default configurations are reviewed and hardened according to security best practices. Additionally, system administrators should regularly audit their display manager configurations to ensure that unnecessary services are not exposed to external networks, as this vulnerability demonstrates how default configurations can create significant security risks without explicit action from administrators.