X.Org Server CIDAFM() integer overflow
| xorg-server-cidafm-overflow (28899) |  High Risk |
Description:
X.Org Server and XFree86 Server are vulnerable to an integer overflow in the CIDAFM() function caused by improper handling of Adobe Font Metrics (AFM) files in libXfont. A local attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the X Server.
Platforms Affected:
- Canonical, Ubuntu 5.04
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- Debian, Debian Linux 3.1
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux 2006 X86_64
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- NetBSD, NetBSD 2.0
- NetBSD, NetBSD 2.0.1
- NetBSD, NetBSD 2.0.2
- NetBSD, NetBSD 2.0.3
- NetBSD, NetBSD 2.0.4
- NetBSD, NetBSD 2.1
- NetBSD, NetBSD 3.0
- NetBSD, NetBSD 3.0.1
- NetBSD, NetBSD 3.0.2
- NetBSD, NetBSD 4.0 beta
- NetBSD, NetBSD CURRENT
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 ES
- RedHat, Linux Advanced Workstation 2.1 Itanium
- X.Org, X.Org Server
- XFree86, XFree86
Remedy:
For X.Org X Server:
Upgrade to the latest version of X.Org libXfont (1.2.1 or later), or apply the appropriate patch for your system, available from the X.Org Foundation Web site. See References.
For XFree86 X Server:
No remedy available as of September 2006.
For Red Hat Linux:
Refer to RHSA-2006:0666-4 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200609-07 for patch, upgrade, or suggested workaround information. See References.
For Mandriva Linux:
Refer to Mandriva Security Advisory MDKSA-2006:164-1 for patch, upgrade, or suggested workaround information. See References.
For NetBSD:
Refer to NetBSD Security Advisory 2006-021 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Privileges
References:
- iDEFENSE ADVISORY: 09.12.06, Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow Vulnerability at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=412.
- NetBSD-SA2006-021, Integer overflows in CID-keyed font parser at http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-021.txt.asc.
- X.Org Foundation Web site, X.Org Foundation at http://www.x.org/.
- XFree86 Web site, XFree@ Home to the X Window System at http://www.xfree86.org/.
- ASA-2006-190: xorg-x11 security update (RHSA-2006-0665)
- ASA-2006-191: XFree86 security update (RHSA-2006-0666)
- ASA-2007-043: Two Integer Overflow Vulnerabilities Found in the Xorg(1) X Server (Sun 102780)
- BID-19974: X.Org LibXfont CID Font File Multiple Integer Overflow Vulnerabilities
- CVE-2006-3739: Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metrics (AFM) files with a modified number of character metrics (StartCharMetrics), which leads to a heap-based buffer overflow.
- DSA-1193: xfree86 -- several vulnerabilities
- GLSA-200609-07: LibXfont, monolithic X.org: Multiple integer overflows
- MDKSA-2006:164: Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
- MDKSA-2006:164-1: Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
- MDKSA-2006:164-2: Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
- RHSA-2006-0665: xorg-x11 security update
- RHSA-2006-0666: XFree86 security update
- SA21864: X11 libXfont CID Encoded Fonts Integer Overflows
- SA21890: XFree86 CID Encoded Fonts Integer Overflows
- SA22141: Avaya Modular Messaging X11 libXfont Integer Overflows
- SA22560: Avaya Products XFree86 Integer Overflow Vulnerabilities
- SA23899: Sun Solaris 10 Xorg X Server Integer Overflows
- SA24636: VMware ESX Server Multiple Security Updates
- SECTRACK ID: 1016828: X Buffer Overflow in Processing CID-encoded Type1 Fonts Lets Remote Users Execute Arbitrary Code
- SUSE-SR:2006:023: SUSE Security Summary Report
- USN-344-1: X.org vulnerabilities
- VUPEN/ADV-2006-3581: X.Org X11 CIDAFM() and scan_cidfont() Local Privilege Escalation Vulnerabilities
- VUPEN/ADV-2006-3582: XFree86 CIDAFM() and scan_cidfont() Local Privilege Escalation Vulnerabilities
- VUPEN/ADV-2007-0322: Sun Solaris Security Update Fixes X.Org X11 Local Privilege Escalation Vulnerabilities
- VUPEN/ADV-2007-1171: VMware ESX Update Fixes Multiple Code Execution and Denial of Service Vulnerabilities
Reported:
Sep 12, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net