Xfree xlib buffer overflow allows arbitrary command execution
| xfree-xlib-bo (5751) |  Medium Risk |
Description:
XFree86 xlib has a display environment variable that fails to properly check for predefined size limits before being copied onto the stack. A local attacker can overflow the buffer and overwrite the stack variables to execute arbitrary code on the system.
Consequences:
Gain Access
Remedy:
For FreeBSD 3.3.x:
Upgrade to the latest version of FreeBSD (4.0.2_5 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-01:07. See references.
For Red Hat Linux 6.2:
Upgrade to the latest version of Xfree86 (3.3.6-29 or later), as listed in RHSA-2001:071-05. See References.
For Red Hat Linux 7.0 and 7.1:
Upgrade to the latest version of Xfree86 (3.3.6-38 or later), as listed in RHSA-2001:071-05. See References.
For SGI IRIX 6.5 - 6.5.11:
Upgrade to the latest version of IRIX (6.5.16 or later), or apply the appropriate patch for your system, as listed in SGI Security Advisory 20020502-01-I. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Thu Oct 12 2000 - 20:42:47 CDT: another Xlib buffer overflow.
- CIAC Information Bulletin M-077: SGI IRIX Xlib Vulnerability.
- FreeBSD Security Advisory FreeBSD-SA-01:07: Multiple XFree86 3.3.6 vulnerabilities.
- SGI Security Advisory 20020502-01-I: Xlib vulnerability.
- BID-1805: XFree86 Xlib Display Buffer Overflow Vulnerability
- CVE-2000-0976: Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display command line parameter.
- RHSA-2001-071: New updated XFree86 packages available
Platforms Affected:
- FreeBSD FreeBSD
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- SGI IRIX 6.5
- SGI IRIX 6.5.1
- SGI IRIX 6.5.10
- SGI IRIX 6.5.11
- SGI IRIX 6.5.2
- SGI IRIX 6.5.3
- SGI IRIX 6.5.4
- SGI IRIX 6.5.5
- SGI IRIX 6.5.6
- SGI IRIX 6.5.7
- SGI IRIX 6.5.8
- SGI IRIX 6.5.9
- XFree86 XFree86 3.3.x
Reported:
Oct 12, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net