X.Org XFS QueryXBitmaps and QueryXExtents buffer overflow

xfs-queryxbitmaps-queryxextents-bo (36920) The risk level is classified as HighHigh Risk

Description:

X.Org XFS is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the handlers for the QueryXBitmaps and QueryXExtents protocol requests. By sending specially-crafted requests to the swap_char2b() function, a local attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system with the privileges of the Web server.

Note: On Solaris systems, remote exploitation is possible via specially-crafted requests to TCP port 7100.

Platforms Affected:

  • Apple, Mac OS X 10.4.11
  • Apple, Mac OS X Server 10.4.11
  • Gentoo, Linux
  • Mandriva, Corporate Server 3.0
  • Mandriva, Corporate Server 3.0 X86_64
  • Mandriva, Corporate Server 4.0 X86_64
  • Mandriva, Corporate Server 4.0
  • Mandriva, Linux 2007
  • Mandriva, Linux 2007 X86_64
  • Mandriva, Linux 2007.1
  • Mandriva, Linux 2007.1 X86_64
  • Novell, Linux POS 9
  • Novell, OpenSUSE 10.2
  • Novell, OpenSUSE 10.3
  • Novell, SLE SDK 10 SP1
  • Novell, SUSE Linux Enterprise Desktop 10 SP1
  • Novell, SUSE Linux Enterprise Server 10 SP1
  • Novell, SUSE Linux Enterprise Server 10
  • RedHat, Enterprise Linux 2.1 AS
  • RedHat, Enterprise Linux 2.1 ES
  • RedHat, Enterprise Linux 2.1 WS
  • RedHat, Enterprise Linux 3 AS
  • RedHat, Enterprise Linux 3 WS
  • RedHat, Enterprise Linux 3 ES
  • RedHat, Enterprise Linux 3 Desktop
  • RedHat, Enterprise Linux 4 AS
  • RedHat, Enterprise Linux 4 Desktop
  • RedHat, Enterprise Linux 4 ES
  • RedHat, Enterprise Linux 4 WS
  • RedHat, Linux Advanced Workstation 2.1 Itanium
  • Sun, Solaris 10 SPARC
  • Sun, Solaris 10 x64
  • Sun, Solaris 8 x86
  • Sun, Solaris 8 SPARC
  • Sun, Solaris 9 x86
  • Sun, Solaris 9 SPARC
  • SuSE, OpenSuSE 10.2
  • SuSE, OpenSuSE 10.3
  • SuSE, SLE SDK 10
  • SuSE, SuSE Linux 10.0
  • SuSE, SuSE Linux 10.1
  • SuSE, SuSE Linux 9.0
  • X.Org, X.Org XFS X11R7.2-1.0.4

Remedy:

Upgrade to the latest version of X.Org XFS (1.0.5 or later), available from the X.Org Foundation Web site. See References.

For other distributions:
Contact your vendor for patch or upgrade information.

Consequences:

Gain Access

References:

  • iDefense PUBLIC ADVISORY: 10.02.07, Multiple Vendor X Font Server Multiple Vulnerabilities at http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602.
  • Sun Alert ID: 103114, Multiple Security Issues Within The X Font Server (xfs(1)) QueryXBitmaps and QueryXExtents Protocol Handlers at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103114-1.
  • X.Org Foundation Web site, X.Org Wiki - Home at http://xorg.freedesktop.org/wiki/Home.
  • ASA-2007-444: Multiple Security Issues Within The X Font Server (xfs(1)) QueryXBitmaps and QueryXExtents Protocol Handlers (Sun 103114)
  • ASA-2008-035: XFree86 security update (RHSA-2008-0029)
  • ASA-2008-036: xorg-x11 security update (RHSA-2008-0030)
  • ASA-2008-051: HP-UX Running X Font Server(xfs) Software Remote Execution of Arbitrary Code (HPSBUX02303)
  • BID-25898: X.Org X Font Server Multiple Memory Corruption Vulnerabilities
  • CVE-2007-4990: The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
  • FrSIRT/ADV-2007-3337: X.Org X11 Server Integer Overflow and Memory Corruption Vulnerabilities
  • FrSIRT/ADV-2007-3338: XFree86 X11 Server Integer Overflow and Memory Corruption Vulnerabilities
  • FrSIRT/ADV-2007-3467: Sun Solaris X Font Server Multiple Remote Code Execution Vulnerabilities
  • FrSIRT/ADV-2008-0149: HP-UX X Font Server (xfs) Remote Command Execution Vulnerability
  • FrSIRT/ADV-2008-0924: Apple Mac OS X Command Execution and Security Bypass Issues
  • GLSA-200710-11: X Font Server: Multiple Vulnerabilities
  • MDKSA-2007:210: Updated xfs package prevents arbitrary code execution vulnerabilities
  • RHSA-2008-0029: Important: XFree86 security update
  • RHSA-2008-0030: Important: xorg-x11 security update
  • SA27040: X.Org X11 X Font Server Multiple Vulnerabilities
  • SA27060: XFree86 X Font Server Multiple Vulnerabilities
  • SA27176: Sun Solaris X Font Server Multiple Vulnerabilities
  • SA29420: Mac OS X Security Update Fixes Multiple Vulnerabilities
  • SECTRACK ID: 1018763: X Font Server Overflows in QueryXBitmaps and QueryXExtents Requests Let Remote Users Execute Arbitrary Code
  • SUSE-SA:2007:054: Xorg security problems

Reported:

Oct 02, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page