X.Org XFS protocol requests buffer overflow
| xfs-protocol-requests-bo (36919) |  High Risk |
Description:
X.Org XFS is vulnerable to a heap-based buffer overflow, caused by an integer overflow error in the handlers for the QueryXBitmaps and QueryXExtents protocol requests. By sending specially-crafted QueryXBitmaps and QueryXExtents requests, a local attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system with the privileges of the Web server.
Note: On Solaris systems, remote exploitation is possible via specially-crafted requests to TCP port 7100.
Platforms Affected:
- Apple, Mac OS X 10.4.11
- Apple, Mac OS X 10.5
- Apple, Mac OS X 10.5.1
- Apple, Mac OS X Server 10.4.11
- Apple, Mac OS X Server 10.5
- Apple, Mac OS X Server 10.5.1
- Debian, Debian Linux 3.1
- Debian, Debian Linux 4.0
- Gentoo, Linux
- Mandriva, Corporate Server 3.0 X86_64
- Mandriva, Corporate Server 3.0
- Mandriva, Corporate Server 4.0
- Mandriva, Corporate Server 4.0 X86_64
- Mandriva, Linux 2007 X86_64
- Mandriva, Linux 2007
- Mandriva, Linux 2007.1 X86_64
- Mandriva, Linux 2007.1
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 AS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Sun, Solaris 10 SPARC
- Sun, Solaris 10 x64
- Sun, Solaris 8 SPARC
- Sun, Solaris 8 x86
- Sun, Solaris 9 SPARC
- Sun, Solaris 9 x86
- X.Org, X.Org XFS X11R7.2-1.0.4
Remedy:
Upgrade to the latest version of X.Org XFS (1.0.5 or later), available from the X.Org Foundation Web site. See References.
For Apple Mac OS X:
Apply Apple Security Update 2008-001 or upgrade to the latest version of Mac OS X (10.5.2 or later), available from the Apple Web site. See References.
For Apple Mac OS X 10.4.11:
Apply the Security Update 2008-002, available from the Apple Web site. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
Consequences:
Gain Access
References:
- Apple Web site, About the security content of Mac OS X 10.5.2 and Security Update 2008-001 at http://docs.info.apple.com/article.html?artnum=307430.
- iDefense PUBLIC ADVISORY: 10.02.07, Multiple Vendor X Font Server Multiple Vulnerabilities at http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602.
- Sun Alert ID: 103114, Multiple Security Issues Within The X Font Server (xfs(1)) QueryXBitmaps and QueryXExtents Protocol Handlers at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103114-1.
- X.Org Foundation Web site, X.Org Wiki - Home at http://xorg.freedesktop.org/wiki/Home.
- ASA-2007-444: Multiple Security Issues Within The X Font Server (xfs(1)) QueryXBitmaps and QueryXExtents Protocol Handlers (Sun 103114)
- ASA-2008-035: XFree86 security update (RHSA-2008-0029)
- ASA-2008-036: xorg-x11 security update (RHSA-2008-0030)
- BID-25898: X.Org X Font Server Multiple Memory Corruption Vulnerabilities
- CVE-2007-4568: Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow.
- DSA-1385: xfs -- several vulnerabilities
- FrSIRT/ADV-2007-3337: X.Org X11 Server Integer Overflow and Memory Corruption Vulnerabilities
- FrSIRT/ADV-2007-3338: XFree86 X11 Server Integer Overflow and Memory Corruption Vulnerabilities
- FrSIRT/ADV-2007-3467: Sun Solaris X Font Server Multiple Remote Code Execution Vulnerabilities
- FrSIRT/ADV-2008-0495: Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
- FrSIRT/ADV-2008-0924: Apple Mac OS X Command Execution and Security Bypass Issues
- GLSA-200710-11: X Font Server: Multiple Vulnerabilities
- MDKSA-2007:210: Updated xfs package prevents arbitrary code execution vulnerabilities
- RHSA-2008-0029: Important: XFree86 security update
- RHSA-2008-0030: Important: xorg-x11 security update
- SA27040: X.Org X11 X Font Server Multiple Vulnerabilities
- SA27060: XFree86 X Font Server Multiple Vulnerabilities
- SA27176: Sun Solaris X Font Server Multiple Vulnerabilities
- SA28891: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
- SA29420: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1018763: X Font Server Overflows in QueryXBitmaps and QueryXExtents Requests Let Remote Users Execute Arbitrary Code
Reported:
Oct 02, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net