http://seclists.org/fulldisclosure/2011/Oct/918
http://vladz.devzero.fr/Xorg-CVE-2011-4029.txt
This PoC sets the rights 444 (read for all) on any file specified as argument (default file is «/etc/shadow»). Another good use for an attacker would be to dump an entire partition in order to disclose its full content later (via a «mount -o loop»). Made for EDUCATIONAL PURPOSES ONLY! In some configurations, this exploit must be launched from a TTY (switch by typing Ctrl-Alt-Fn). Tested on Debian 6.0.2 up to date with X default configuration issued from the xserver-xorg-core package (version 2:1.7.7-13).
