Xfree xlib buffer overflow allows arbitrary command execution
| xfree-xlib-bo (5751) |  Medium Risk |
Description:
XFree86 xlib has a display environment variable that fails to properly check for predefined size limits before being copied onto the stack. A local attacker can overflow the buffer and overwrite the stack variables to execute arbitrary code on the system.
Platforms Affected:
- FreeBSD, FreeBSD
- RedHat, Linux 6.2
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- SGI, IRIX 6.5
- SGI, IRIX 6.5.1
- SGI, IRIX 6.5.10
- SGI, IRIX 6.5.11
- SGI, IRIX 6.5.2
- SGI, IRIX 6.5.3
- SGI, IRIX 6.5.4
- SGI, IRIX 6.5.5
- SGI, IRIX 6.5.6
- SGI, IRIX 6.5.7
- SGI, IRIX 6.5.8
- SGI, IRIX 6.5.9
- XFree86, XFree86 3.3.x
Remedy:
For FreeBSD 3.3.x:
Upgrade to the latest version of FreeBSD (4.0.2_5 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-01:07. See references.
For Red Hat Linux 6.2:
Upgrade to the latest version of Xfree86 (3.3.6-29 or later), as listed in RHSA-2001:071-05. See References.
For Red Hat Linux 7.0 and 7.1:
Upgrade to the latest version of Xfree86 (3.3.6-38 or later), as listed in RHSA-2001:071-05. See References.
For SGI IRIX 6.5 - 6.5.11:
Upgrade to the latest version of IRIX (6.5.16 or later), or apply the appropriate patch for your system, as listed in SGI Security Advisory 20020502-01-I. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Thu Oct 12 2000 - 20:42:47 CDT, another Xlib buffer overflow at http://archives.neohapsis.com/archives/bugtraq/2000-10/0211.html.
- CIAC Information Bulletin M-077, SGI IRIX Xlib Vulnerability at http://www.ciac.org/ciac/bulletins/m-077.shtml.
- FreeBSD Security Advisory FreeBSD-SA-01:07, Multiple XFree86 3.3.6 vulnerabilities at http://archives.neohapsis.com/archives/freebsd/2001-01/0536.html.
- SGI Security Advisory 20020502-01-I, Xlib vulnerability at ftp://patches.sgi.com/support/free/security/advisories/20020502-01-I.
- BID-1805: XFree86 Xlib Display Buffer Overflow Vulnerability
- CVE-2000-0976: Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display command line parameter.
- RHSA-2001-071: New updated XFree86 packages available
Reported:
Oct 12, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net