The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.

From Red Hat Security Advisory 2007:0520 :

Updated X.org packages that address a flaw in the way the X.Org X11 xfs font server starts are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The X.Org X11 xfs font server provides a standard mechanism for an X server to communicate with a font renderer.

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of a file of their choosing, possibly elevating their local privileges. (CVE-2007-3103)

Users of the X.org X11 xfs font server should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

From Red Hat Security Advisory 2007:0519 :

Updated X.org packages that correct a flaw in the way the X.Org X11 xfs font server starts are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of the file of their choosing, possibly elevating their local privileges (CVE-2007-3103).

Users of X.org should upgrade to these updated packages, which contain a backported patch and are not vulnerable to these issues.

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of a file of their choosing, possibly elevating their local privileges. (CVE-2007-3103)

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of the file of their choosing, possibly elevating their local privileges (CVE-2007-3103).

Updated X.org packages that address a flaw in the way the X.Org X11 xfs font server starts are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The X.Org X11 xfs font server provides a standard mechanism for an X server to communicate with a font renderer.

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of a file of their choosing, possibly elevating their local privileges. (CVE-2007-3103)

Users of the X.org X11 xfs font server should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

- Mon Apr 13 2009 Adam Jackson <ajax at redhat.com>     1.0.5-2.1

    - xfs.init: Fix mkdir race (#492517)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Apr 13 2009 Adam Jackson <ajax at redhat.com>     1.0.5-3.1

    - xfs.init: Fix mkdir race (#492517)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-11 (X Font Server: Multiple Vulnerabilities)

    iDefense reported that the xfs init script does not correctly handle a     race condition when setting permissions of a temporary file     (CVE-2007-3103). Sean Larsson discovered an integer overflow     vulnerability in the build_range() function possibly leading to a     heap-based buffer overflow when handling 'QueryXBitmaps' and     'QueryXExtents' protocol requests (CVE-2007-4568). Sean Larsson also     discovered an error in the swap_char2b() function possibly leading to a     heap corruption when handling the same protocol requests     (CVE-2007-4990).
  Impact :

    The first issue would allow a local attacker to change permissions of     arbitrary files to be world-writable by performing a symlink attack.
    The second and third issues would allow a local attacker to execute     arbitrary code with privileges of the user running the X Font Server,     usually xfs.
  Workaround :

    There is no known workaround at this time.

It was discovered that a race condition in the init.d script of the X Font Server allows the modification of file permissions of arbitrary files if the local administrator can be tricked into restarting the X font server.

Updated X.org packages that correct a flaw in the way the X.Org X11 xfs font server starts are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A temporary file flaw was found in the way the X.Org X11 xfs font server startup script executes. A local user could modify the permissions of the file of their choosing, possibly elevating their local privileges (CVE-2007-3103).

Users of X.org should upgrade to these updated packages, which contain a backported patch and are not vulnerable to these issues.

ID	Name	Product	Family	Severity
67529	Oracle Linux 5 : xorg-x11-xfs (ELSA-2007-0520)	Nessus	Oracle Linux Local Security Checks	medium
67528	Oracle Linux 4 : xorg-x11 (ELSA-2007-0519)	Nessus	Oracle Linux Local Security Checks	medium
60225	Scientific Linux Security Update : xorg-x11-xfs on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60224	Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43644	CentOS 5 : xorg-x11-xfs (CESA-2007:0520)	Nessus	CentOS Local Security Checks	medium
39593	Fedora 9 : xorg-x11-xfs-1.0.5-2.1.fc9 (2009-3666)	Nessus	Fedora Local Security Checks	medium
39592	Fedora 10 : xorg-x11-xfs-1.0.5-3.1.fc10 (2009-3651)	Nessus	Fedora Local Security Checks	medium
27046	GLSA-200710-11 : X Font Server: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
25825	Debian DSA-1342-1 : xfs - race condition	Nessus	Debian Local Security Checks	medium
25723	RHEL 5 : xorg-x11-xfs (RHSA-2007:0520)	Nessus	Red Hat Local Security Checks	medium
25722	RHEL 4 : xorg-x11 (RHSA-2007:0519)	Nessus	Red Hat Local Security Checks	medium
25712	CentOS 4 : xorg-x11 (CESA-2007:0519)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-3103

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium