The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
X Server Extensions Memory Corruption Vulnerabilities
------------------------------------------------------------------------
SUMMARY
The <http://en.wikipedia.org/wiki/X_Window_System > X Window System is a
graphical windowing system based on a client/server model.
Local exploitation of three different memory corruption vulnerabilities in
the X.Org and XFree86 X server could allow an attacker to execute
arbitrary code with privileges of the X server, typically root.
DETAILS
Vulnerable Systems:
* X.Org server versions 7.1-1.1.0.
* Previous versions may also be affected.
Local exploitation of a memory corruption vulnerability in the
"ProcRenderAddGlyphs" function lies within the Render extension.
Insufficient input validation exists when allocating memory for glyph
management data structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6101>
CVE-2006-6101)
Local exploitation of a memory corruption vulnerability in the
"ProcDbeGetVisualInfo" function lies within the DBE extension.
Insufficient input validation exists when allocating memory for data
structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6102>
CVE-2006-6102)
Local exploitation of a memory corruption vulnerability in the
"ProcDbeSwapBuffers" function lies within the DBE extension. Insufficient
input validation exists when allocating memory for data structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6102>
CVE-2006-6103)
By sending a specially crafted X protocol request to specific extension,
an attacker can cause an exploitable memory corruption condition.
Workaround:
Access to the vulnerable code can be prevented when the vulnerable
extension is not built into the X binary. This can be accomplished by
removing the entry for the DBE extension from your X server's
configuration file, often stored in /etc/X11 and named xorg.conf or
XF86Config-4. To do this, remove the following lines from the 'Module'
section:
Load "DBE"
Load "render"
This will prevent the render extension from loading, which may affect the
appearance or operation of some applications.
Disclosure Timeline:
* 12-04-06 - Initial vendor notification
* 12-05-06 - Initial vendor response
* 01-09-07 - Coordinated public disclosure
ADDITIONAL INFORMATION
The original articles can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=464
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
