SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   X Vendors:   X.org
(Red Hat Issues Fix for libXfont ) X11 Overflows Let Local Users Gain Root Privileges
SecurityTracker Alert ID:  1017862
SecurityTracker URL:  http://securitytracker.com/id/1017862
CVE Reference:   CVE-2007-1351, CVE-2007-1352   (Links to External Site)
Date:  Apr 3 2007
Impact:   Execution of arbitrary code via local system, Root access via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Several vulnerabilities were reported in X. A local user can obtain elevated privileges on the target system.

A local user can trigger an integer overflow in the processing of BDF fonts to execute arbitrary code on the target system with root privileges [CVE-2007-1351].

A local user can trigger an integer overflow in 'fonts.dir' to execute arbitrary code on the target system with root privileges [CVE-2007-1352].

A local user can trigger an integer overflow in the XC-MISC extension to execute arbitrary code on the target system with root privileges [CVE-2007-1003].

Sean Larsson of iDefense Labs discovered the XC-MISC extension vulnerability. iDefense reported the other two vulnerabilities.

Impact:   A local user can obtain root privileges on the target system.
Solution:   Red Hat has released a fix for libXfont for CVE-2007-1351 CVE-2007-1352.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2007-0132.html
Vendor URL:  wiki.x.org/wiki/Development/Security?action=show&redirect=SecurityPage (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
Apr 3 2007 X11 Overflows Let Local Users Gain Root Privileges


 Source Message Contents
Date:  Tue, 3 Apr 2007 15:17:59 -0400
Subject:  [RHSA-2007:0132-01] Important: libXfont security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: libXfont security update
Advisory ID:       RHSA-2007:0132-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0132.html
Issue date:        2007-04-03
Updated on:        2007-04-03
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-1351 CVE-2007-1352 
- ---------------------------------------------------------------------

1. Summary:

Updated X.org libXfont packages that fix a security issue are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

X.org is an open source implementation of the X Window System. It provides
the basic low-level functionality that full-fledged graphical user
interfaces are designed upon.

iDefense reported two integer overflows in the way X.org handled various
font files. A malicious local user could exploit these issues to
potentially execute arbitrary code with the privileges of the X.org server.
(CVE-2007-1351, CVE-2007-1352)

Users of X.org libXfont should upgrade to these updated packages, which
contain a backported patch and are not vulnerable to this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

234058 - CVE-2007-1351 Multiple font integer overflows (CVE-2007-1352)

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libXfont-1.2.2-1.0.2.el5.src.rpm
cebbaf955689613a4da4a13e70048bc9  libXfont-1.2.2-1.0.2.el5.src.rpm

i386:
4353d56aeba21ccafa8f1bbf0c657a44  libXfont-1.2.2-1.0.2.el5.i386.rpm
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm

x86_64:
4353d56aeba21ccafa8f1bbf0c657a44  libXfont-1.2.2-1.0.2.el5.i386.rpm
8921098af8f63c467e03faf813de0501  libXfont-1.2.2-1.0.2.el5.x86_64.rpm
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm
fe9f087eb1935ceb0ea544523d64abaa  libXfont-debuginfo-1.2.2-1.0.2.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libXfont-1.2.2-1.0.2.el5.src.rpm
cebbaf955689613a4da4a13e70048bc9  libXfont-1.2.2-1.0.2.el5.src.rpm

i386:
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm
a79829992fad2158b5b3f1f37e917d05  libXfont-devel-1.2.2-1.0.2.el5.i386.rpm

x86_64:
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm
fe9f087eb1935ceb0ea544523d64abaa  libXfont-debuginfo-1.2.2-1.0.2.el5.x86_64.rpm
a79829992fad2158b5b3f1f37e917d05  libXfont-devel-1.2.2-1.0.2.el5.i386.rpm
a4f8fc9719241360073507e5ee4f71eb  libXfont-devel-1.2.2-1.0.2.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/libXfont-1.2.2-1.0.2.el5.src.rpm
cebbaf955689613a4da4a13e70048bc9  libXfont-1.2.2-1.0.2.el5.src.rpm

i386:
4353d56aeba21ccafa8f1bbf0c657a44  libXfont-1.2.2-1.0.2.el5.i386.rpm
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm
a79829992fad2158b5b3f1f37e917d05  libXfont-devel-1.2.2-1.0.2.el5.i386.rpm

ia64:
816dec2b8f2a72d5ab47afad494ce128  libXfont-1.2.2-1.0.2.el5.ia64.rpm
58710dd335d8c9a88d23446ce73f48b9  libXfont-debuginfo-1.2.2-1.0.2.el5.ia64.rpm
b467c7ec1bd61bdfa55118c658d64c66  libXfont-devel-1.2.2-1.0.2.el5.ia64.rpm

ppc:
1d6311c46bd83b598083d415937adb2e  libXfont-1.2.2-1.0.2.el5.ppc.rpm
0331576de1d63b54159c16564d69c098  libXfont-1.2.2-1.0.2.el5.ppc64.rpm
4dd1bfc60a0a739cb9d786762b51ca69  libXfont-debuginfo-1.2.2-1.0.2.el5.ppc.rpm
1582d43ed5db3cb3682dc003ed392d84  libXfont-debuginfo-1.2.2-1.0.2.el5.ppc64.rpm
4eb2668a3160e080ba4cd5ea5b66f553  libXfont-devel-1.2.2-1.0.2.el5.ppc.rpm
537c0b1ce6e6fa60efa9e341fa056776  libXfont-devel-1.2.2-1.0.2.el5.ppc64.rpm

s390x:
2ec26a64f65361dc4586fe48a02aedd6  libXfont-1.2.2-1.0.2.el5.s390.rpm
ff4bab53c981c8da60911edebbf7b9c6  libXfont-1.2.2-1.0.2.el5.s390x.rpm
91716ea76da2c3e189ae5fd0dd498f06  libXfont-debuginfo-1.2.2-1.0.2.el5.s390.rpm
af4cedc903ffcee19430e73e026987ca  libXfont-debuginfo-1.2.2-1.0.2.el5.s390x.rpm
10e487c8f8a608d5e73a5148789a44ce  libXfont-devel-1.2.2-1.0.2.el5.s390.rpm
3a87733755c9e8cd117aadee9eea56d1  libXfont-devel-1.2.2-1.0.2.el5.s390x.rpm

x86_64:
4353d56aeba21ccafa8f1bbf0c657a44  libXfont-1.2.2-1.0.2.el5.i386.rpm
8921098af8f63c467e03faf813de0501  libXfont-1.2.2-1.0.2.el5.x86_64.rpm
baec95cb7d9e1949b4ab1dfe4827720a  libXfont-debuginfo-1.2.2-1.0.2.el5.i386.rpm
fe9f087eb1935ceb0ea544523d64abaa  libXfont-debuginfo-1.2.2-1.0.2.el5.x86_64.rpm
a79829992fad2158b5b3f1f37e917d05  libXfont-devel-1.2.2-1.0.2.el5.i386.rpm
a4f8fc9719241360073507e5ee4f71eb  libXfont-devel-1.2.2-1.0.2.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFGEqhmXlSAg2UNWIIRAiSkAKChsQorzCcaRJyH5cp2EkbSHjqyMwCdEiUw
pf1bYLNj4hEuStnTMcc+J8k=
=n6d0
-----END PGP SIGNATURE-----



-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC