[UNIX] X.Org Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



X.Org Privilege Escalation
------------------------------------------------------------------------


SUMMARY

"The <http://wiki.x.org/wiki/> X.Org Foundation provides an open source
implementation of the X Window System."

A privileges escalation with X.org allows attackers to gain root
privileges

DETAILS

Vulnerable Systems:
* xorg-server version 1.0.0, as shipped with X11R7.0
* xorg-server version X11R7.0rc
* xorg-server version X11R6.9.0
* xorg-server version X11R6.9.0rc
* xorg-server version X11R6.8.2
* xorg-server version X11R6.8.2rc

When parsing arguments, the server checks that only root can pass the
option -modulepath, which determines the location to load many modules
providing server functionality from, and -logfile, which determines the
location of the logfile. Normally, these locations cannot be changed by
unprivileged users.

This test was changed to test the effective UID as well as the real UID in
X.Org. The test is defective in that it tested the address of the geteuid
function, not the result of the function itself. As a result, given that
the address of geteuid() is always non-zero, an unprivileged user can load
modules from any location on the filesystem with root privileges, or
overwrite critical system files with the server log.

Proof of Concept:
The proof of concpet can be found:
<http://metasploit.com/users/hdm/tools/xmodulepath.tgz>
http://metasploit.com/users/hdm/tools/xmodulepath.tgz

Vendor Status:
The vendor has issued a fix:
X11R7 tree: <http://xorg.freedesktop.org/releases/X11R7.0/patches/>
http://xorg.freedesktop.org/releases/X11R7.0/patches/
xorg-server 1.0.2 has been released with this and other code fixes:
<http://xorg.freedesktop.org/releases/individual/xserver/>
http://xorg.freedesktop.org/releases/individual/xserver/
Apply the patch below to the X.Org server as distributed with X11R6.9:
<http://xorg.freedesktop.org/releases/X11R6.9.0/patches/>
http://xorg.freedesktop.org/releases/X11R6.9.0/patches/

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0745>
CVE-2006-0745


ADDITIONAL INFORMATION

The information has been provided by <mailto:daniel@xxxxxxxxxxxxx> Daniel
Stone.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages