[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[linux-security] local root exploit in X

Topic
=====
local root exploit in X due to buffer overflows

Problem Description
===================
XFree86 is an implementation of the X Window System, providing the core
graphical user interface and video drivers.

Two buffer overflows were discovered in the parsing of the 'font.alias'
file. A local attacker could exploit this vulnerability by creating a
carefully-crafted file and gaining root privileges.
  
Additional flaws exists in the reading of font files.

Affected Versions
=================
XFree86 versions 4.1.0 - 4.3.0

Solution
========
Upgrade to XFree86-4.3.99.903 (release candidate) or patched version
for your distribution

Mandrake 9.0
------------
rpm -Fvh XFree86-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-Xnest-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-Xvfb-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-glide-module-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-libs-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-server-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-xfs-4.2.1-3.5.90mdk.i586.rpm \
         X11R6-contrib-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-75dpi-fonts-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-100dpi-fonts-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-cyrillic-fonts-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-devel-4.2.1-3.5.90mdk.i586.rpm \
         XFree86-static-libs-4.2.1-3.5.90mdk.i586.rpm

Mandrake 9.1
------------
rpm -Fvh XFree86-4.3-8.7.91mdk.i586.rpm \
         XFree86-Xnest-4.3-8.7.91mdk.i586.rpm \
         XFree86-Xvfb-4.3-8.7.91mdk.i586.rpm \
         XFree86-glide-module-4.3-8.7.91mdk.i586.rpm \
         XFree86-libs-4.3-8.7.91mdk.i586.rpm \
         XFree86-server-4.3-8.7.91mdk.i586.rpm \
         XFree86-xfs-4.3-8.7.91mdk.i586.rpm \
         X11R6-contrib-4.3-8.7.91mdk.i586.rpm \
         XFree86-75dpi-fonts-4.3-8.7.91mdk.i586.rpm \
         XFree86-100dpi-fonts-4.3-8.7.91mdk.i586.rpm \
         XFree86-cyrillic-fonts-4.3-8.7.91mdk.i586.rpm \
         XFree86-devel-4.3-8.7.91mdk.i586.rpm \
         XFree86-static-libs-4.3-8.7.91mdk.i586.rpm

Mandrake 9.2
------------
rpm -Fvh XFree86-4.3-24.4.92mdk.i586.rpm \
         XFree86-Xnest-4.3-24.4.92mdk.i586.rpm \
         XFree86-Xvfb-4.3-24.4.92mdk.i586.rpm \
         XFree86-glide-module-4.3-24.4.92mdk.i586.rpm \
         XFree86-server-4.3-24.4.92mdk.i586.rpm \
         XFree86-xfs-4.3-24.4.92mdk.i586.rpm \
         libxfree86-4.3-24.4.92mdk.i586.rpm \
         X11R6-contrib-4.3-24.4.92mdk.i586.rpm \
         XFree86-75dpi-fonts-4.3-24.4.92mdk.i586.rpm \
         XFree86-100dpi-fonts-4.3-24.4.92mdk.i586.rpm \
         XFree86-cyrillic-fonts-4.3-24.4.92mdk.i586.rpm \
         libxfree86-devel-4.3-24.4.92mdk.i586.rpm \
         libxfree86-static-devel-4.3-24.4.92mdk.i586.rpm

Fedora 1.0
----------
rpm -Fvh XFree86-4.3.0-55.i386.rpm \
         XFree86-devel-4.3.0-55.i386.rpm \
         XFree86-font-utils-4.3.0-55.i386.rpm \
         XFree86-xfs-4.3.0-55.i386.rpm \
         XFree86-twm-4.3.0-55.i386.rpm \
         XFree86-xdm-4.3.0-55.i386.rpm \
         XFree86-libs-4.3.0-55.i386.rpm \
         XFree86-libs-data-4.3.0-55.i386.rpm \
         XFree86-base-fonts-4.3.0-55.i386.rpm \
         XFree86-truetype-fonts-4.3.0-55.i386.rpm \
         XFree86-syriac-fonts-4.3.0-55.i386.rpm \
         XFree86-75dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-100dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-2-75dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-2-100dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-9-75dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-9-100dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-14-75dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-14-100dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-15-75dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-ISO8859-15-100dpi-fonts-4.3.0-55.i386.rpm \
         XFree86-cyrillic-fonts-4.3.0-55.i386.rpm \
         XFree86-doc-4.3.0-55.i386.rpm \
         XFree86-Xnest-4.3.0-55.i386.rpm \
         XFree86-Xvfb-4.3.0-55.i386.rpm \
         XFree86-tools-4.3.0-55.i386.rpm \
         XFree86-xauth-4.3.0-55.i386.rpm \
         XFree86-Mesa-libGL-4.3.0-55.i386.rpm \
         XFree86-Mesa-libGLU-4.3.0-55.i386.rpm \
         XFree86-sdk-4.3.0-55.i386.rpm

SFU 1.0 (RedHat 7.3)
--------------------
(packages can be found at http://www.sfu.ca/acs/security/linux/7.3/
or on sphinx.sfu.ca in /vol/vol0/distrib/sfu/1.0/RPMS)

rpm -Fvh XFree86-4.2.1-24.i386.rpm \
         XFree86-libs-4.2.1-24.i386.rpm \
         XFree86-twm-4.2.1-24.i386.rpm \
         XFree86-xdm-4.2.1-24.i386.rpm \
         XFree86-xf86cfg-4.2.1-24.i386.rpm \
         XFree86-xfs-4.2.1-24.i386.rpm \
         XFree86-Xnest-4.2.1-24.i386.rpm \
         XFree86-Xvfb-4.2.1-24.i386.rpm \
         XFree86-tools-4.2.1-24.i386.rpm \
         XFree86-100dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-75dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-base-fonts-4.2.1-24.i386.rpm \
         XFree86-cyrillic-fonts-4.2.1-24.i386.rpm \
         XFree86-devel-4.2.1-24.i386.rpm \
         XFree86-doc-4.2.1-24.i386.rpm \
         XFree86-font-utils-4.2.1-24.i386.rpm \
         XFree86-ISO8859-15-100dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-ISO8859-15-75dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-ISO8859-2-100dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-ISO8859-2-75dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-ISO8859-9-100dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-ISO8859-9-75dpi-fonts-4.2.1-24.i386.rpm \
         XFree86-truetype-fonts-4.2.1-24.i386.rpm