Attachment 15498 Details for Bug 15222 – Render vulnerabilities draft advisory

Render vulnerabilities draft advisory

pub_Multiple Vendor X Server Render Extension Multiple Integer Overflow Vulnerabilities.txt (text/plain), 3.78 KB, created by Matthieu Herrb on 2008-03-27 03:36:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2008-03-27 03:36:58 UTC

Size: 3.78 KB

patch

obsolete

>iDefense Security Advisory XX.XX.XX
>http://labs.idefense.com/intelligence/vulnerabilities/
>MMM DD, YYYY
>
>I. BACKGROUND
>
>The X Window System is a graphical windowing system based on a
>client/server model. More information about about The X Window system
>is available at the following links.
>
>http://en.wikipedia.org/wiki/X_Window_System
>
>II. DESCRIPTION
>
>Local exploitation of multiple integer overflow vulnerabilities in the
>X.Org X server, as included in various vendors' operating system
>distributions, could allow an attacker to execute arbitrary code with
>the privileges of the X server, typically root.
>
> Multiple vulnerabilities are present in the Render extension in the
>code responsible for reading in client requests. The following
>functions contain vulnerabilities:
>
>AllocateGlyph() ProcRenderCreateCursor()
>SProcRenderCreateLinearGradient()
>
>In each case, values are taken from the client request and used in
>arithmetic operations that calculate the size of dynamic buffers. These
>calculations can overflow, which results in undersized buffers being
>allocated. The allocated buffers are then overflowed with data from the
>client request.
>
>III. ANALYSIS
>
>Exploitation allows an attacker to execute arbitrary code with the
>privileges of the X server, typically root. In order to exploit this
>vulnerability, an attacker must be able to send commands to an affected
>X server. This typically requires access to the console or access to the
>same account as a user who is on the console. One method of gaining the
>required access is to remotely exploit a vulnerability in, for example,
>a graphical web browser. This would then allow an attacker to exploit
>this vulnerability and elevate their privileges to root.
>
>If an X Server is configured to listen for TCP based client connections,
>and a client is granted access to create sessions (via the xhosts file),
>then these vulnerabilities can be exploited remotely.
>
>IV. DETECTION
>
>iDefense has confirmed the existence of these vulnerabilities in X.org
>X11 version R7.3, with all patches as of 03/01/08 applied. Previous
>versions may also be affected.
>
>V. WORKAROUND
>
>Access to the vulnerable code can be prevented by preventing the X
>server from loading the Render extension. However, doing so may
>seriously impair the functionality of the server. Adding the following
>lines to the X configuration file will disable the Render extension:
>
>Section "Extensions"   Option "RENDER" "disable" EndSection
>
>VI. VENDOR RESPONSE
>
>iDefense is currently working with the vendor to address these issues.
>Since there is no vendor fix at this time, please handle this
>information with sensitivity.
>
>VII. CVE INFORMATION
>
>A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
>been assigned yet.
>
>VIII. DISCLOSURE TIMELINE
>
>XX/XX/XXXX  Initial vendor notification
>
>IX. CREDIT
>
>This vulnerability was reported to iDefense by regenrecht.
>
>Get paid for vulnerability research
>http://labs.idefense.com/methodology/vulnerability/vcp.php
>
>Free tools, research and upcoming events
>http://labs.idefense.com/
>
>X. LEGAL NOTICES
>
>Copyright © 2008 iDefense, Inc.
>
>Permission is granted for the redistribution of this alert
>electronically. It may not be edited in any way without the express
>written consent of iDefense. If you wish to reprint the whole or any
>part of this alert in any other medium other than electronically,
>please e-mail customerservice@idefense.com for permission.
>
>Disclaimer: The information in the advisory is believed to be accurate
>at the time of publishing based on currently available information. Use
>of the information constitutes acceptance for use in an AS IS condition.
> There are no warranties with regard to this information. Neither the
>author nor the publisher accepts any liability for any direct,
>indirect, or consequential loss or damage arising from use of, or
>reliance on, this information.

Actions: View

Attachments on bug 15222: 15497 | 15498 | 15499 | 15500 | 15614 | 16341 | 16473 | 16477 | 16478 | 16513 | 16793

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.