CVE-2002-1160 in Linux
Summary
by MITRE
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user s credentials after root uses su.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability described in CVE-2002-1160 represents a critical privilege escalation flaw within the pluggable authentication modules framework on unix-like systems. This issue specifically affects the pam_xauth module which is responsible for managing X11 authentication cookies during user sessions. The vulnerability stems from the insecure default configuration that fails to properly handle authentication cookie management when transitioning between user contexts, creating a pathway for local attackers to exploit system security controls. The flaw operates by leveraging the temporary creation of .xauth files during system operations, particularly when root executes the su command to switch user contexts.
The technical mechanism behind this vulnerability involves the improper handling of MIT-Magic-Cookies, which are authentication tokens used by the X Window System to control access to graphical sessions. When root uses the su command to switch to another user account, the system creates a temporary .xauth file that contains the original user's authentication credentials. The pam_xauth module, in its default configuration, fails to properly secure or isolate these cookies, allowing a local user to access the temporary .xauth file and extract the authentication tokens. This process effectively enables privilege escalation because the extracted cookies can be used to gain unauthorized access to X sessions that were originally protected by the elevated privileges of the root account.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass broader security implications for graphical session management. Attackers can leverage this flaw to bypass normal access controls and potentially gain root privileges without requiring additional authentication mechanisms. The vulnerability is particularly concerning because it exploits the trust relationships between system components, specifically between the authentication framework and the X11 session management system. The attack requires only local access to the system, making it difficult to detect and defend against since it operates within the normal system execution paths. This weakness creates a persistent security risk that can be exploited by any local user with minimal privileges, potentially leading to complete system compromise.
Mitigation strategies for CVE-2002-1160 should focus on proper configuration of the pam_xauth module and implementation of additional security controls. System administrators should ensure that the pam_xauth module is configured to properly secure authentication cookies during user context switches, particularly when root privileges are involved. The recommended approach involves modifying the module's behavior to prevent automatic forwarding of authentication tokens or implementing proper file permissions on temporary .xauth files. Security controls should include regular auditing of authentication cookie handling, implementation of proper access controls on temporary files, and monitoring for unauthorized access attempts to X session authentication data. This vulnerability aligns with CWE-276, which describes improper file permissions, and represents a classic example of privilege escalation through insecure default configurations. The mitigation efforts should also consider implementing principle of least privilege for all system components and ensuring that temporary files created during authentication processes are properly secured against unauthorized access. Organizations should also implement comprehensive logging and monitoring to detect anomalous access patterns that might indicate exploitation attempts.