X.Org X11 MIT-SHM extension integer overflow
| xorg-mitshm-overflow (39764) |  High Risk |
Description:
X.Org X11 is vulnerable to an integer overflow caused by improper bounds checking by the MIT-SHM extension. If the X server is configured for TCP connections, a remote attacker could create a pixmap with a specially calculated size to overflow a buffer and execute arbitrary code on the system with root privileges.
Platforms Affected:
- Apple, Mac OS X 10.4.11
- Apple, Mac OS X 10.5.2
- Apple, Mac OS X Server 10.4.11
- Apple, Mac OS X Server 10.5.2
- Avaya, Call Management System 12
- Avaya, Call Management System 13
- Avaya, Call Management System 13.1
- Avaya, Call Management System 14
- Avaya, Interactive Response 2.0
- Avaya, Interactive Response 3.0
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Debian, Debian Linux 3.1
- Debian, Debian Linux 4.0
- Gentoo, Linux
- HP, HP-UX B.11.11
- IBM, AIX 5.2
- IBM, AIX 5.3
- IBM, AIX 6.1
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- Novell, Linux Desktop 9
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, OpenSUSE 10.2
- Novell, OpenSUSE 10.3
- Novell, SLE SDK 10 SP1
- Novell, SUSE Linux Enterprise Desktop 10 SP1
- Novell, SUSE Linux Enterprise Server 10
- Novell, SUSE Linux Enterprise Server 10 SP1
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Sun, Solaris 10 x86
- Sun, Solaris 10 SPARC
- Sun, Solaris 8 x86
- Sun, Solaris 8 SPARC
- Sun, Solaris 9 x86
- Sun, Solaris 9 SPARC
- SuSE, SLE SDK 10
- SuSE, SuSE Linux 9.0
- SuSE, SuSE SLES 9
- X.Org, X.Org X11 R7.3 and prior
Remedy:
Upgrade to the latest version of X.Org X11 (1.4 or later), available from the X.Org Foundation Web site. See References.
For Sun Solaris:
Refer to Sun Alert ID: 103200 for patch, upgrade, or suggested workaround information. See References.
For Mac OS X:
Apply Security Update 2008-002, available from the Apple Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Gain Privileges
References:
- Apple Web site, About Security Update 2008-002 at http://docs.info.apple.com/article.html?artnum=307562.
- ASA-2008-077, A Security Vulnerability in the Solaris X Window System (X(5)) PCF Font Handler May Lead to Execution of Arbitrary Code or a Denial of Service (DoS) Condition at http://support.avaya.com/elmodocs2/security/ASA-2008-077.htm.
- ASA-2008-078, Multiple Security Vulnerabilities in the Solaris X Server Extensions May Lead to a Denial of Service (DoS) Condition or Allow Execution of Arbitrary Code at http://support.avaya.com/elmodocs2/security/ASA-2008-078.htm.
- BugTraq Mailing List, Wed Mar 05 2008 - 14:48:03 CST, X.Org X server and Xfont library: Multiple vulnerabilities at http://archives.neohapsis.com/archives/bugtraq/2008-03/0049.html.
- HPSBUX02381 SSRT080083 rev.1, HP-UX Running Xserver, Remote Execution of Arbitrary Code at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321.
- IBM Subscription service Bulletin 4136, AIX X server multiple vulnerabilities at http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200802/SECURITY/20080227/datafile112539&label=AIX%20X%20server%20multiple%20vulnerabilities.
- iDefense PUBLIC ADVISORY: 01.17.08, Multiple Vendor X Server EVI and MIT-SHM Extensions Integer Overflow Vulnerabilities at http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=645.
- Sun Alert ID: 103200, Multiple Security Vulnerabilities in the Solaris X Server Extensions May Lead to a Denial of Service (DoS) Condition or Allow Execution of Arbitrary Code at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103200-1.
- X.Org Foundation Web site, X.Org Wiki - Home at http://xorg.freedesktop.org/wiki/Home.
- X.Org Mailing List, Thu Jan 17 06:05:34 PST 2008, X.Org security advisory: multiple vulnerabilities in the X server at http://lists.freedesktop.org/archives/xorg/2008-January/031918.html.
- ASA-2008-035: XFree86 security update (RHSA-2008-0029)
- ASA-2008-036: xorg-x11 security update (RHSA-2008-0030)
- ASA-2008-039: Multiple Security Vulnerabilities in the Solaris X Server Extensions May Lead to a Denial of Service (DoS) Condition or Allow Execution of Arbitrary Code
- ASA-2008-078: Multiple Security Vulnerabilities in the Solaris X Server Extensions May Lead to a Denial of Service (DoS) Condition or Allow Execution of Arbitrary Code (Sun 200153)
- ASA-2008-431: HPSBUX02381 SSRT080083 rev.1 - HP-UX Running Xserver Remote Execution of Arbitrary Code
- BID-27336: RETIRED: X.Org X Server Local Privilege Escalation and Information Disclosure Vulnerabilities
- BID-27350: X.Org X Server 'MIT-SHM' Local Privilege Escalation Vulnerability
- BID-27353: X.Org X Server 'EVI' Extension Local Privilege Escalation Vulnerability
- CVE-2007-6429: Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.
- DSA-1466: xorg-server -- several vulnerabilities
- GLSA-200801-09: X.Org X server and Xfont library: Multiple vulnerabilities
- MDVSA-2008:021: Updated XFree86 packages fix multiple vulnerabilities
- MDVSA-2008:022: Updated xorg-x11 packages fix multiple vulnerabilities
- MDVSA-2008:023: Updated x11-server packages fix multiple vulnerabilities
- MDVSA-2008:025: Updated x11-server-xgl packages fix multiple vulnerabilities
- RHSA-2008-0029: Important: XFree86 security update
- RHSA-2008-0030: Important: xorg-x11 security update
- RHSA-2008-0031: Important: xorg-x11-server security update
- SA28532: X.org X11 Multiple Vulnerabilities
- SA28550: Sun Solaris X Window System and X Server Multiple Vulnerabilities
- SA28693: Avaya CMS Solaris X Window System and X Server Multiple Vulnerabilities
- SA28885: NX Server X11 Multiple Vulnerabilities
- SA28941: Avaya CMS Sun Solaris X Window System and X Server Vulnerabilities
- SA29139: IBM AIX X Server Multiple Vulnerabilities
- SA29420: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SA30161: Gentoo ltsp Multiple Vulnerabilities
- SA32545: HP-UX Xserver Multiple Vulnerabilities
- SECTRACK ID: 1019232: X Server Bugs in XFree86, Xinput, TOG-CUP, MIT-SHM, and EVI Extensions Let Local Users Gain Root Privileges
- SUSE-SA:2008:003: Xorg Security Problems
- SUSE-SR:2008:003: SUSE Security Summary Report
- SUSE-SR:2008:008: SUSE Security Summary Advisory
- USN-571-1: X.org vulnerabilities
- USN-571-2: X.org regression
- VUPEN/ADV-2008-0179: X.Org X11 Integer Overflow and Memory Corruption Vulnerabilities
- VUPEN/ADV-2008-0184: Sun Solaris X Windows Integer Overflow and Memory Corruption Issues
- VUPEN/ADV-2008-0497: NoMachine NX Server Security Update Fixes X11 Multiple Vulnerabilities
- VUPEN/ADV-2008-0703: IBM AIX Privilege Escalation and Remote Code Execution Vulnerabilities
- VUPEN/ADV-2008-0924: Apple Mac OS X Command Execution and Security Bypass Issues
- VUPEN/ADV-2008-3000: HP-UX Xserver Multiple Remote Code Execution Vulnerabilities
Reported:
Jan 17, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net