X.Org and XFree86 X server DBE ProcDbeSwapBuffers() integer overflow
| xorg-xserver-dbe-swap-overflow (31379) |  High Risk |
Description:
X.Org and XFree86 X server could allow a local attacker to execute arbitrary code on the system with elevated privileges, caused by an integer overflow in the ProcDbeSwapBuffers() function in the DBE extension. A local attacker with privileges to send commands to the X Server could exploit this vulnerability using a specially-crafted X protocol request to corrupt memory and execute arbitrary code on the system with the privileges of the X server.
Platforms Affected:
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Debian, Debian Linux 3.1
- Gentoo, Linux
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
- HP, HP-UX B.11.31
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- Novell, Linux Desktop 9
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, OpenSUSE 10.2
- Novell, UnitedLinux 1.0
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Sun, Solaris 10
- Sun, Solaris 8
- Sun, Solaris 9
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 10.1
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.3
- SuSE, SuSE Linux OpenExchange Server 4
- SuSE, SuSE Linux Retail Solution 8
- SuSE, SuSE Linux School Server
- SuSE, SuSE Linux Standard Server 8
- SuSE, SuSE SLED 10
- SuSE, SuSE SLES 10
- SuSE, SuSE SLES 9
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Multimedia
- Turbolinux, Turbolinux Personal
- Turbolinux, Turbolinux wizpy
- X.Org, X.Org Server 6.8.2
- X.Org, X.Org Server 6.9.0
- X.Org, X.Org Server 7.0
- X.Org, X.Org Server 7.1
- X.Org, X11
- XFree86, XFree86 X Server
Remedy:
For Turbolinux (xorg-x11):
Refer to TLSA-2007-14 for patch, upgrade, or suggested workaround information. See References.
For X.Org:
Apply the appropriate patch for this vulnerability as listed in the XOrg-ANNOUNCE Mailing List posting dated Tue Jan 9 06:14:56 PST 2007. See References.
For Red Hat Linux (X.Org):
Refer to RHSA-2007:0003-3 for patch, upgrade, or suggested workaround information. See References.
For Debian GNU/Linux (XFree86):
Refer to DSA-1249-1 for patch, upgrade, or suggested workaround information. See References.
For SUSE Linux (XFree86):
Refer to SUSE Security Announcement SUSE-SA:2007:008 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200701-25 for patch, upgrade, or suggested workaround information. See References.
For Solaris:
Refer to Sun Alert ID: 102803 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux (XFree86):
Refer to RHSA-2007:0002 for patch, upgrade, or suggested workaround information. See References.
For Ubuntu:
Refer to USN-403-1 for patch, upgrade, or suggested workaround information. See References.
For HP-UX (Xserver):
Refer to HPSBUX02225 SSRT071295 rev.1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Privileges
References:
- HPSBUX02225 SSRT071295 rev.1, HP-UX Running Xserver, Local Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678.
- iDefense Labs PUBLIC ADVISORY: 01.09.07, Multiple Vendor X Server DBE Extension ProcDbeSwapBuffers Memory Corruption Vulnerability at http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465.
- Sun Alert ID: 102803, Multiple Integer Overflow Vulnerabilities in the X Font Server (xfs(1)) and the X Render and DBE Extensions at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102803-1.
- X.Org Foundation Web site, X.Org Wiki - Home at http://xorg.freedesktop.org/wiki/Home.
- XFree86 Web site, XFree86 Home to the X Window System at http://www.xfree86.org/.
- XOrg-ANNOUNCE Mailing List, Tue Jan 9 06:14:56 PST 2007, X.Org Security Advisory: multiple integer overflows in dbe and render extensions at http://lists.freedesktop.org/archives/xorg-announce/2007-January/000235.html.
- ASA-2007-061: ASA-2007-061 - xorg-x11 security update (RHSA-2007-0003)
- ASA-2007-066: XFree86 security update (RHSA-2007-0002)
- ASA-2007-074: Multiple Integer Overflow Vulnerabilities in the X Font Server (xfs(1)) and the X Render and DBE Extensions (Sun 102803)
- ASA-2007-267: HPSBUX02225 SSRT071295 rev.1 - HP-UX Running Xserver Local Denial of Service (DoS)
- BID-21968: X.Org DBE And Render Extensions Multiple Local Integer Overflow Vulnerabilities
- CVE-2006-6103: Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
- DSA-1249: xfree86 -- several vulnerabilities
- GLSA-200701-25: X.Org X server: Multiple vulnerabilities
- MDKSA-2007:005: Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
- RHSA-2007-0002: Important: XFree86 security update
- RHSA-2007-0003: Important: xorg-x11 security update
- SA23670: X.Org X11 "DBE" and "Render" Extensions Vulnerabilities
- SA23684: XFree86 "DBE" and "Render" Extensions Vulnerabilities
- SA24168: Sun Solaris X Font Server / X Render and DBE Extensions Vulnerabilities
- SA24210: Avaya Products XFree86 "DBE" and "Render" Extensions Vulnerabilities
- SA24247: Avaya CMS xfs / X Render and DBE Extensions Vulnerabilities
- SECTRACK ID: 1017495: X Memory Corruption Errors in Render and DBE Extensions Let Local Users Gain Root Privileges
- SUSE-SA:2007:008: XFree86/Xorg security problems
Reported:
Jan 09, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net