Attachment 11443 Details for Bug 12298 – iDefense draft

iDefense draft

pub_Multiple Vendor X Font Server build_range() Server Integer Overflow Vulnerability.txt (text/plain), 3.43 KB, created by Matthieu Herrb on 2007-09-05 23:35:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2007-09-05 23:35:10 UTC

Size: 3.43 KB

patch

obsolete

>Multiple Vendor X Font Server build_range() Server Integer Overflow Vulnerability
>
>iDefense Security Advisory XX.XX.XX
>http://labs.idefense.com/intelligence/vulnerabilities/
>MMM DD, YYYY
>
>I. BACKGROUND
>
>Xfs is the X Window System font server. It is used to render fonts for
>the X server. More information can be found on the vendor's website.
>
>http://www.x.org/wiki/
>
>II. DESCRIPTION
>
>Remote exploitation of an integer overflow vulnerability in X.Org
>Foundation's X Font Server, as included in various vendors' operating
>system distributions, could allow an attacker to execute arbitrary
>code.
>
>The vulnerability exists within the handlers for the QueryXBitmaps and
>QueryXExtents protocol requests. Both of these requests result in a
>call to the build_range() function. This function takes a 32bit integer
>from the request, and uses it in an arithmetic operation that calculates
>the size of a dynamic buffer. This calculation can overflow, which leads
>to an improperly sized memory allocation. This results in a heap
>overflow.
>
>III. ANALYSIS
>
>Successful exploitation of this vulnerability results in the execution
>of arbitrary code with the privileges of the X Font Server, usually
>'xfs'. Exploitation of this vulnerability is difficult due to the
>nature of the overflow. A large number of bytes are copied into a small
>buffer, which usually results in a segmentation fault when unmapped
>memory is written to. However, the attacker has significant control
>over the heap, and it may be possible to create a memory layout that
>makes exploitation possible.
>
>On modern Linux systems, this vulnerability is only locally exploitable.
>XFS no longer listens on tcp port 7100 on current distributions. On
>current versions of Solaris, this vulnerability is remotely
>exploitable. The XFS service is turned on by default, and listens on
>tcp port 7100.
>
>IV. DETECTION
>
>iDefense has confirmed the existence of this vulnerability in XFS
>version X11R7.2-1.0.4. Previous versions may also be affected.
>
>V. WORKAROUND
>
>On Solaris, stop XFS from listening remotely by disabling it via the
>service manager.
>
>VI. VENDOR RESPONSE
>
>iDefense is currently working with the vendor to address this issue.
>Since there is no vendor fix at this time, please handle this
>information with sensitivity.
>
>VII. CVE INFORMATION
>
>A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
>been assigned yet.
>
>VIII. DISCLOSURE TIMELINE
>
>XX/XX/XXXX  Initial vendor notification
>
>IX. CREDIT
>
>This vulnerability was discovered by Sean Larsson, iDefense Labs.
>
>Get paid for vulnerability research
>http://labs.idefense.com/methodology/vulnerability/vcp.php
>
>Free tools, research and upcoming events
>http://labs.idefense.com/
>
>X. LEGAL NOTICES
>
>Copyright © 2007 iDefense, Inc.
>
>Permission is granted for the redistribution of this alert
>electronically. It may not be edited in any way without the express
>written consent of iDefense. If you wish to reprint the whole or any
>part of this alert in any other medium other than electronically,
>please e-mail customerservice@idefense.com for permission.
>
>Disclaimer: The information in the advisory is believed to be accurate
>at the time of publishing based on currently available information. Use
>of the information constitutes acceptance for use in an AS IS condition.
> There are no warranties with regard to this information. Neither the
>author nor the publisher accepts any liability for any direct,
>indirect, or consequential loss or damage arising from use of, or
>reliance on, this information.

Actions: View

Attachments on bug 12298: 11443 | 11450 | 11502 | 11585 | 11596

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.