CVE-2009-1573 | Vulnerability Database | Aqua Security

xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.

Affected Software

Name	Vendor	Start Version	End Version
Debian_linux	Debian	*	*
Fedora	Redhat	10 (including)	10 (including)
Linux	Ubuntu	*	*
Xorg-server	Ubuntu	dapper	*
Xorg-server	Ubuntu	hardy	*
Xorg-server	Ubuntu	intrepid	*
Xorg-server	Ubuntu	jaunty	*

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526678
http://secunia.com/advisories/39834
http://www.openwall.com/lists/oss-security/2009/05/05/2
http://www.openwall.com/lists/oss-security/2009/05/05/4
http://www.securityfocus.com/bid/34828
http://www.ubuntu.com/usn/USN-939-1
http://www.vupen.com/english/advisories/2010/1185
https://exchange.xforce.ibmcloud.com/vulnerabilities/50348
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526678
http://secunia.com/advisories/39834
http://www.openwall.com/lists/oss-security/2009/05/05/2
http://www.openwall.com/lists/oss-security/2009/05/05/4
http://www.securityfocus.com/bid/34828
http://www.ubuntu.com/usn/USN-939-1
http://www.vupen.com/english/advisories/2010/1185
https://exchange.xforce.ibmcloud.com/vulnerabilities/50348

NVD	https://nvd.nist.gov/vuln/detail/CVE-2009-1573
CWE	https://cwe.mitre.org/data/definitions/264.html