[UNIX] X Server Extensions Memory Corruption Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



X Server Extensions Memory Corruption Vulnerabilities
------------------------------------------------------------------------


SUMMARY

The <http://en.wikipedia.org/wiki/X_Window_System > X Window System is a
graphical windowing system based on a client/server model.

Local exploitation of three different memory corruption vulnerabilities in
the X.Org and XFree86 X server could allow an attacker to execute
arbitrary code with privileges of the X server, typically root.

DETAILS

Vulnerable Systems:
* X.Org server versions 7.1-1.1.0.
* Previous versions may also be affected.

Local exploitation of a memory corruption vulnerability in the
"ProcRenderAddGlyphs" function lies within the Render extension.
Insufficient input validation exists when allocating memory for glyph
management data structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6101>
CVE-2006-6101)

Local exploitation of a memory corruption vulnerability in the
"ProcDbeGetVisualInfo" function lies within the DBE extension.
Insufficient input validation exists when allocating memory for data
structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6102>
CVE-2006-6102)

Local exploitation of a memory corruption vulnerability in the
"ProcDbeSwapBuffers" function lies within the DBE extension. Insufficient
input validation exists when allocating memory for data structures. (
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6102>
CVE-2006-6103)

By sending a specially crafted X protocol request to specific extension,
an attacker can cause an exploitable memory corruption condition.

Workaround:
Access to the vulnerable code can be prevented when the vulnerable
extension is not built into the X binary. This can be accomplished by
removing the entry for the DBE extension from your X server's
configuration file, often stored in /etc/X11 and named xorg.conf or
XF86Config-4. To do this, remove the following lines from the 'Module'
section:
Load "DBE"
Load "render"

This will prevent the render extension from loading, which may affect the
appearance or operation of some applications.

Disclosure Timeline:
* 12-04-06 - Initial vendor notification
* 12-05-06 - Initial vendor response
* 01-09-07 - Coordinated public disclosure


ADDITIONAL INFORMATION

The original articles can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=464

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Internet Explorer Code Execution Through MIME Manipulation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... file that contains active content (JavaScript etc) and give it a jpg ... extension, then convince a user to access that so called image but instead ... This allows someone to cause a file that ends with jpg to not be processed ...
    (Securiteam)
  • [UNIX] XOOPS Weak File Validation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... images through the avatar uploading mechanism if "Allow custom avatar ... This is due to weak file extension validation of the XoopsMediaUploader ...
    (Securiteam)
  • [UNIX] DoKuWiki Weak File Validation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Weak file validation in DoKuWiki allows user with upload privileges to ... extension, this by appending an allowed extension into the middle of the ...
    (Securiteam)