|
X.org X11 Multiple Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA28532
|
|
|
Release Date:
|
2008-01-18
|
|
Last Update:
|
2008-03-20
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
Privilege escalation
DoS
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | X Window System 11 (X11) 6.x
X Window System 11 (X11) 7.x
|
| | CVE reference: | CVE-2007-5760 (Secunia mirror)
CVE-2007-5958 (Secunia mirror)
CVE-2007-6427 (Secunia mirror)
CVE-2007-6428 (Secunia mirror)
CVE-2007-6429 (Secunia mirror)
CVE-2008-0006 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Some vulnerabilities have been reported in X.org X11, which can be exploited by malicious, local users to cause a DoS (Denial of Service), disclose potentially sensitive information, or to gain escalated privileges.
1) An array indexing error within the XFree86 Misc extension can be exploited to execute arbitrary code by sending a specially crafted PassMessage request.
2) An integer overflow error within the EVI extension can be exploited to cause a heap-based buffer overflow via a specially crafted GetVisualInfo request.
3) An integer overflow error within the MIT-SHM extension can be exploited to overwrite arbitrary memory addresses by creating a pixmap with a specially calculated size.
4) An array indexing error within the "ProcGetReservedColormapEntries()" function from the TOG-CUP extension can be exploited to disclose arbitrary memory.
5) An error in multiple functions contained within the Xinput extension when swapping the byte order of received requests can be exploited to corrupt heap memory.
6) An error exists within the processing of security policy arguments when executing X. This can be exploited to determine the existence of restricted files by passing the file names as arguments to the "X -sp" command.
7) A boundary error exists within the X server when processing PCF fonts. This can be exploited to cause a buffer overflow via a PCF font containing a specially crafted PCF_BDF_ENCODINGS table with the difference between the "last col" and "first col" elements being greater than 255.
The vulnerabilities are reported in X.org X11 version R7.3 and prior.
Solution:
Apply vendor patches.
ftp://ftp.freedesktop.org/pub/xorg/X1...g-xserver-1.2-multiple-overflows.diff
MD5: 238affb8697e6f095dbb6fe66ceb7873
xorg-xserver-1.2-multiple-overflows.diff
SHA1: 6df37147742fcdf429cc980f1a528f1c888efdcb
xorg-xserver-1.2-multiple-overflows.diff
ftp://ftp.freedesktop.org/pub/xorg/X1...g-xserver-1.4-multiple-overflows.diff
MD5: 7aadd3ead8c3bd098413fef91af7d35f
xorg-xserver-1.4-multiple-overflows.diff
SHA1: b3c9013aa6abc30fabd8f6a85e427f5fd6e6ef6c
xorg-xserver-1.4-multiple-overflows.diff
ftp://ftp.freedesktop.org/pub/xorg/X1...s/xorg-libXfont-1.3.1-pcf-parser.diff
MD5: f6ea1bae4c5fb279e679fece589eaab6 xorg-libXfont-1.3.1-pcf-parser.diff
SHA1: 1d7a07ddb2efa8b56b51c7fad58b7e8e17c6421c
xorg-libXfont-1.3.1-pcf-parser.diff
Provided and/or discovered by:
1 - 5) Discovered by regenrecht, reported via iDefense Labs.
6) Takuya Shiozaki
7) Discovered by an anonymous researcher, reported by the vendor.
Changelog:
2008-03-20: Added link to US-CERT.
Original Advisory:
iDefense Labs:
1) http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=646
2, 3) http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=645
4) http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=644
5) http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=643
X.Org:
http://lists.freedesktop.org/archives/xorg/2008-January/031918.html
Other References:
US-CERT VU#203220:
http://www.kb.cert.org/vuls/id/203220
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
16 Related Secunia Security Advisories, displaying 10
|
|
|
1. X.Org X11 X Font Server Multiple Vulnerabilities
|
|
2. X.org X11 Composite Pixmap Privilege Escalation Vulnerability
|
|
3. X.Org X11 Multiple Vulnerabilities
|
|
4. X.Org X11 "DBE" and "Render" Extensions Vulnerabilities
|
|
5. libX11 XCOMPOSEFILE File Descriptor Leak
|
|
6. X.Org X11 X Display Manager "Xsession" Script Security Issue
|
|
7. X11 libXfont CID Encoded Fonts Integer Overflows
|
|
8. X11 "_XKB_CHARSET" Buffer Overflow Vulnerability
|
|
9. X.Org X11 setuid Security Issues
|
|
10. X11 libXfont PCF Integer Overflow Vulnerability
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
