The accelerated rendering functionality of NVIDIA Binary Graphics Driver (binary blob driver) For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite arbitrary memory locations.

Derek Abdine discovered that the NVIDIA Xorg driver did not correctly verify the size of buffers used to render text glyphs. When displaying very long strings of text, the Xorg server would crash. If a user were tricked into viewing a specially crafted series of glyphs, this flaw could be exploited to run arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in the NVIDIA Xorg driver was discovered by Derek Abdine who found that it did not correctly verify the size of buffers used to render text glyphs, resulting in a crash of the server when displaying very long strings of text. If a user was tricked into viewing a specially crafted series of glyphs, this flaw could be exploited to run arbitrary code with root privileges.

This vulnerability exists in driver versions 1.0-8762 and 1.0-8774 and is corrected in 1.0-8776 which is being provided with this update.

The packages can be found in the non-free/updates media.

Pam_ldap does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
This might lead to an attacker being able to login into a suspended system account.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200611-03 (NVIDIA binary graphics driver: Privilege escalation vulnerability)

    Rapid7 reported a boundary error in the NVIDIA binary graphics driver     that leads to a buffer overflow in the accelerated rendering     functionality.
  Impact :

    An X client could trigger the buffer overflow with a maliciously     crafted series of glyphs. A remote attacker could also entice a user to     open a specially crafted web page, document or X client that will     trigger the buffer overflow. This could result in the execution of     arbitrary code with root privileges or at least in the crash of the X     server.
  Workaround :

    Disable the accelerated rendering functionality in the Device section     of xorg.conf :
    Option      'RenderAccel' 'false'

Rapid7 reports :

The NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page). A working proof-of-concept root exploit is included with this advisory.

The NVIDIA drivers for Solaris and FreeBSD are also likely to be vulnerable.

Disabling Render acceleration in the 'nvidia' driver, via the 'RenderAccel' X configuration option, can be used as a workaround for this issue.

ID	Name	Product	Family	Severity
27959	Ubuntu 6.06 LTS / 6.10 : linux-restricted-modules-2.6.15, linux-restricted-modules-2.6.17 vulnerability (USN-377-1)	Nessus	Ubuntu Local Security Checks	high
24623	Mandrake Linux Security Advisory : nvidia (MDKSA-2007:007)	Nessus	Mandriva Local Security Checks	high
24586	Mandrake Linux Security Advisory : pam_ldap (MDKSA-2006:201)	Nessus	Mandriva Local Security Checks	high
23668	GLSA-200611-03 : NVIDIA binary graphics driver: Privilege escalation vulnerability	Nessus	Gentoo Local Security Checks	high
22911	FreeBSD : NVIDIA UNIX driver -- arbitrary root code execution vulnerability (a6d9da4a-5d5e-11db-8faf-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-5379

high

Tenable Plugins

high

high

high

high

high