X11 Overflows Let Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1017857
|
|
SecurityTracker URL: http://securitytracker.com/id?1017857
|
|
CVE Reference: CVE-2007-1003
, CVE-2007-1351
, CVE-2007-1352
(Links to External Site)
|
Date: Apr 3 2007
|
Impact: Execution of arbitrary code via local system, Root access via local system, User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 7.2 and prior versions
|
Description: Several vulnerabilities were reported in X. A local user can obtain elevated privileges on the target system.
A local user can trigger an integer overflow in the processing of BDF fonts to execute arbitrary code on the target system with root
privileges [CVE-2007-1351].
A local user can trigger an integer overflow in 'fonts.dir' to execute arbitrary code on the target
system with root privileges [CVE-2007-1352].
A local user can trigger an integer overflow in the XC-MISC extension to execute
arbitrary code on the target system with root privileges [CVE-2007-1003].
Sean Larsson of iDefense Labs discovered the XC-MISC
extension vulnerability. iDefense reported the other two vulnerabilities.
|
Impact: A local user can obtain root privileges on the target system.
|
Solution: The vendor has issued a patch for 7.2.
[Editor's note: The vendor's patch and security advisory were not available at the time of this entry.]
|
Vendor URL: wiki.x.org/wiki/Development/Security?action=show&redirect=SecurityPage (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 3 Apr 2007 16:50:19 -0400
Subject: X
|
http://wiki.x.org/wiki/Development/Security?action=show&redirect=SecurityPage
April 3, 2007 - CVE-2007-1003 CVE-2007-1351 CVE-2007-1352 CVE-2007-1352: Lack of
validation of parameters passed to the X server and libX11 by client application can
lead to various kinds of integer overflows or stack overflows that can be used to
overwrite data in the X server memory.
|
|
