X.Org X server and Xfont library: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 200801-09 / xorg-server libXfont |
| Release Date |
January 20, 2008 |
| Latest Revision |
March 05, 2008: 03 |
| Impact |
high |
| Exploitable |
remote, local |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| x11-base/xorg-server |
<
1.3.0.0-r5 |
>=
1.3.0.0-r5 |
All supported architectures
|
| x11-libs/libXfont |
<
1.3.1-r1 |
>=
1.3.1-r1 |
All supported architectures
|
Related bugreports:
#204362, #208343
Synopsis
Multiple vulnerabilities have been discovered in the X.Org X server and
Xfont library, allowing for a local privilege escalation and arbitrary code
execution.
2.
Impact Information
Background
The X Window System is a graphical windowing system based on a
client/server model.
Description
regenrecht reported multiple vulnerabilities in various X server
extension via iDefense:
- The XFree86-Misc extension does not properly sanitize a parameter
within a PassMessage request, allowing the modification of a function
pointer (CVE-2007-5760).
- Multiple functions in the XInput extension do not properly sanitize
client requests for swapping bytes, leading to corruption of heap
memory (CVE-2007-6427).
- Integer overflow vulnerabilities in the EVI extension and in the
MIT-SHM extension can lead to buffer overflows (CVE-2007-6429).
- The TOG-CUP extension does not sanitize an index value in the
ProcGetReservedColormapEntries() function, leading to arbitrary memory
access (CVE-2007-6428).
- A buffer overflow was discovered in the Xfont library when
processing PCF font files (CVE-2008-0006).
- The X server does not enforce restrictions when a user specifies a
security policy file and attempts to open it (CVE-2007-5958).
Impact
Remote attackers could exploit the vulnerability in the Xfont library
by enticing a user to load a specially crafted PCF font file resulting
in the execution of arbitrary code with the privileges of the user
running the X server, typically root. Local attackers could exploit
this and the vulnerabilities in the X.org extensions to gain elevated
privileges. If the X server allows connections from the network, these
vulnerabilities could be exploited remotely. A local attacker could
determine the existence of arbitrary files by exploiting the last
vulnerability or possibly cause a Denial of Service.
3.
Resolution Information
Workaround
Workarounds for some of the vulnerabilities can be found in the X.Org
security advisory as listed under References.
Resolution
All X.Org X server users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.3.0.0-r5"
|
All X.Org Xfont library users should upgrade to the latest version:
Code Listing 3.2: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.3.1-r1"
|
4.
References
|
