CVE-2000-0374

Vulnerability

The default configuration of the K Display Manager (kdm) in Caldera and Mandrake Linux, and potentially other distributions, accepts X Display Manager Control Protocol (XDMCP) connections from any host without restriction. This is a configuration issue present in the default setup of kdm, leaving the service exposed to network-wide access.

Exploitation

An attacker needs only network access to the target system's XDMCP service (typically on port 177). No authentication is required; the attacker can initiate an XDMCP connection from any remote machine, sending a query or request to the kdm server.

Impact

A successful XDMCP connection can allow the attacker to obtain sensitive information, such as the list of available display managers or system details, or to bypass additional access restrictions that the administrator might have intended. The exact impact depends on the environment, but it fundamentally leaks information and weakens the access control boundary.

Mitigation

No fix is explicitly described in the available references. As a general best practice, administrators should configure kdm to restrict XDMCP connections to trusted hosts only, or disable XDMCP entirely if not needed. Given the age of this vulnerability (1999), it is likely that modern distributions no longer ship with this dangerous default.