Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.

A number of buffer overflows were recently discovered in XFree86, prompted by initial discoveries by iDEFENSE. These buffer overflows are present in the font alias handling. An attacker with authenticated access to a running X server may exploit these vulnerabilities to obtain root privileges on the machine running the X server.

Trevor Johnson reported that the Red Hat Linux RPMs used by linux_base contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling.

New XFree86 base packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix overflows which could possibly be exploited to gain unauthorized root access. All sites running XFree86 should upgrade to the new package.

A number of vulnerabilities have been discovered in XFree86. The corrections are listed below with the identification from the Common Vulnerabilities and Exposures (CVE) project :

  - CAN-2004-0083 :
    Buffer overflow in ReadFontAlias from dirfile.c of     XFree86 4.1.0 through 4.3.0 allows local users and     remote attackers to execute arbitrary code via a font     alias file (font.alias) with a long token, a different     vulnerability than CAN-2004-0084.

  - CAN-2004-0084 :

    Buffer overflow in the ReadFontAlias function in XFree86     4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered     function, allows local or remote authenticated users to     execute arbitrary code via a malformed entry in the font     alias (font.alias) file, a different vulnerability than     CAN-2004-0083.

  - CAN-2004-0106 :

    Miscellaneous additional flaws in XFree86's handling of     font files.

  - CAN-2003-0690 :

    xdm does not verify whether the pam_setcred function     call succeeds, which may allow attackers to gain root     privileges by triggering error conditions within PAM     modules, as demonstrated in certain configurations of     the MIT pam_krb5 module.

  - CAN-2004-0093, CAN-2004-0094 :

    Denial-of-service attacks against the X server by     clients using the GLX extension and Direct Rendering     Infrastructure are possible due to unchecked client data     (out-of-bounds array indexes [CAN-2004-0093] and integer     signedness errors [CAN-2004-0094]).

Exploitation of CAN-2004-0083, CAN-2004-0084, CAN-2004-0106, CAN-2004-0093 and CAN-2004-0094 would require a connection to the X server. By default, display managers in Debian start the X server with a configuration which only accepts local connections, but if the configuration is changed to allow remote connections, or X servers are started by other means, then these bugs could be exploited remotely.
Since the X server usually runs with root privileges, these bugs could potentially be exploited to gain root privileges.

No attack vector for CAN-2003-0690 is known at this time.

The remote host is affected by the vulnerability described in GLSA-200402-02 (XFree86 Font Information File Buffer Overflow)

    Exploitation of a buffer overflow in The XFree86 Window System     discovered by iDefence allows local attackers to gain root     privileges.
    The problem exists in the parsing of the 'font.alias' file. The X     server (running as root) fails to check the length of the user     provided input, so a malicious user may craft a malformed     'font.alias' file causing a buffer overflow upon parsing,     eventually leading to the execution of arbitrary code.
    To reproduce the overflow on the command line one can run:
    # cat > fonts.dir <<EOF     1     word.bdf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1     EOF     # perl -e 'print '0' x 1024 . 'A' x 96 . '\\n'' > fonts.alias     # X :0 -fp $PWD     {Some output removed}... Server aborting... Segmentation fault (core dumped)   Impact :

    Successful exploitation can lead to a root compromise provided     that the attacker is able to execute commands in the X11     subsystem. This can be done either by having console access to the     target or through a remote exploit against any X client program     such as a web-browser, mail-reader or game.
  Workaround :

    No immediate workaround is available; a software upgrade is required.
    Gentoo has released XFree 4.2.1-r3, 4.3.0-r4 and 4.3.99.902-r1 and     encourages all users to upgrade their XFree86     installations. Vulnerable versions are no longer available in     Portage.

Two buffer overflow vulnerabilities were found by iDEFENSE in XFree86's parsing of the font.alias file. The X server, which runs as root, fails to check the length of user-provided input; as a result a malicious user could craft a malformed font.alias file causing a buffer overflow upon parsing, which could eventually lead to the execution of arbitrary code.

Additional vulnerabilities were found by David Dawes, also in the reading of font files.

The updated packages have a patch from David Dawes to correct these vulnerabilities.

The remote host is missing the patch for the advisory SuSE-SA:2004:006 (xf86/XFree86).


XFree86 is an open source X Window System implementation that acts as a client-server-based API between different hardware components like display, mouse, keyboard and so on.
Several buffer overflows were found in the fontfile code that handles a user-supplied 'fonts.alias' file. The file is processed with root privileges and therefore a successful exploitation of these bugs leads to local root access.

There is no known workaround.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, to apply the update use the command 'rpm -Fhv file.rpm'.

Updated XFree86 packages that fix a privilege escalation vulnerability are now available.

XFree86 is an implementation of the X Window System, providing the core graphical user interface and video drivers.

iDefense discovered two buffer overflows in the parsing of the 'font.alias' file. A local attacker could exploit this vulnerability by creating a carefully-crafted file and gaining root privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0083 and CVE-2004-0084 to these issues.

Additionally David Dawes discovered additional flaws in reading font files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0106 to these issues.

All users of XFree86 are advised to upgrade to these erratum packages, which contain a backported fix and are not vulnerable to these issues.

Red Hat would like to thank David Dawes from XFree86 for the patches and notification of these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated XFree86 packages that fix a privilege escalation vulnerability are now available.

[Update 16 February 2004] Erratum filelist has been modified for x86_64 and s390x only so that the correct multi-lib packages are available.

XFree86 is an implementation of the X Window System, providing the core graphical user interface and video drivers.

iDefense discovered two buffer overflows in the parsing of the 'font.alias' file. A local attacker could exploit this vulnerability by creating a carefully-crafted file and gaining root privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0083 and CVE-2004-0084 to these issues.

Additionally David Dawes discovered additional flaws in reading font files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0106 to these issues.

All users of XFree86 are advised to upgrade to these erratum packages, which contain a backported fix and are not vulnerable to these issues.

Red Hat would like to thank David Dawes from XFree86 for the patches and notification of these issues.

Updated XFree86 packages that fix a privilege escalation vulnerability are now available.

XFree86 is an implementation of the X Window System, providing the core graphical user interface and video drivers.

iDefense discovered two buffer overflows in the parsing of the 'font.alias' file. A local attacker could exploit this vulnerability by creating a carefully-crafted file and gaining root privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0083 and CVE-2004-0084 to these issues.

Additionally David Dawes discovered additional flaws in reading font files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0106 to these issues.

All users of XFree86 are advised to upgrade to these erratum packages, which contain a backported fix and are not vulnerable to these issues.

Red Hat would like to thank David Dawes from XFree86 for the patches and notification of these issues.

ID	Name	Product	Family	Severity
37616	FreeBSD : Buffer overflows in XFree86 servers (3837f462-5d6b-11d8-80e3-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	critical
19106	FreeBSD : linux_base -- vulnerabilities in Red Hat 7.1 libraries (bf2e7483-d3fa-440d-8c6e-8f1f2f018818)	Nessus	FreeBSD Local Security Checks	critical
18771	Slackware 8.1 / 9.0 / 9.1 / current : XFree86 security update (SSA:2004-043-02)	Nessus	Slackware Local Security Checks	critical
15280	Debian DSA-443-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
14446	GLSA-200402-02 : XFree86 Font Information File Buffer Overflow	Nessus	Gentoo Local Security Checks	critical
14112	Mandrake Linux Security Advisory : XFree86 (MDKSA-2004:012)	Nessus	Mandriva Local Security Checks	critical
13824	SuSE-SA:2004:006: xf86/XFree86	Nessus	SuSE Local Security Checks	critical
13677	Fedora Core 1 : XFree86-4.3.0-55 (2004-069)	Nessus	Fedora Local Security Checks	critical
12466	RHEL 3 : XFree86 (RHSA-2004:061)	Nessus	Red Hat Local Security Checks	critical
12465	RHEL 2.1 : XFree86 (RHSA-2004:060)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-0083

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical