X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4772-1 advisory.

  - X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers     to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted     string length value in a XkbSetGeometry request. (CVE-2015-0255)

  - Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome     before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based     buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to     CVE-2015-2716. (CVE-2015-1283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Oracle Secure Global Desktop installed on the remote host is version 4.63 / 4.71 / 5.1 / 5.2. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in Kerberos 5 due     to a failure to properly determine the acceptability of     checksums. A remote attacker can exploit this to forge     tokens or gain privileges by using an unkeyed checksum.
    (CVE-2010-1324)

  - A NULL pointer deference flaw exists in the function     bdfReadCharacters() in file bdfread.c of the X.Org     libXfont module due to improper handling of non-readable     character bitmaps. An authenticated, remote attacker,     using a crafted BDF font file, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2015-1803)

  - An out-of-bounds read/write error exists in the     SProcXFixesSelectSelectionInput() function in the     XFixes extension. A remote, authenticated attacker,     using a crafted length value, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2014-8102)

  - A remote attacker, by using a crafted string length     value in an XkbSetGeometry request, can gain access to     sensitive information from process memory or cause a     denial of service. (CVE-2015-0255)

  - An invalid read error exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A denial of service vulnerability exists in Apache     Tomcat due to improper handling of HTTP responses     that occurs before finishing reading an entire request     body. A remote attacker can exploit this by using a     crafted series of aborted upload attempts.
    (CVE-2014-0230)

  - A denial of service vulnerability exists in Apache     Tomcat in ChunkedInputFilter.java due to improper     handling of attempts to read data after an error has     occurred. A remote attacker can exploit this by     streaming data with malformed chunked-transfer     encoding. (CVE-2014-0227)

  - A NULL pointer dereference flaw exists in the     dtls1_get_record() function when handling DTLS messages.
    A remote attacker, using a specially crafted DTLS     message, can cause a denial of service. (CVE-2014-3571)

  - An unspecified flaw exists that is related to the     JServer subcomponent. A remote attacker can exploit this     to impact confidentiality and integrity. No further     details have been provided. (CVE-2015-2581)

The remote host is affected by the vulnerability described in GLSA-201504-06 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

tigervnc and fltk were updated to fix security issues and non-security bugs.

This security issue was fixed :

  - CVE-2015-0255: Information leak in the XkbSetGeometry     request of X servers (bnc#915810).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xorg-x11-server was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-0255: Check string lengths in XkbSetGeometry     request (bnc#915810)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer over-read flaw was found in the way the X.Org server handled XkbGetGeometry requests. A malicious, authorized client could use this flaw to disclose portions of the X.Org server memory, or cause the X.Org server to crash using a specially crafted XkbGetGeometry request. (CVE-2015-0255)

Olivier Fourdan discovered that missing input validation in the Xserver's handling of XkbSetGeometry requests may result in an information leak or denial of service.

This upload to Debian squeeze-lts fixes the issue by not swapping XkbSetGeometry data in the input buffer any more and checking strings' length against request size.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated xorg-x11-server packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A buffer over-read flaw was found in the way the X.Org server handled XkbGetGeometry requests. A malicious, authorized client could use this flaw to disclose portions of the X.Org server memory, or cause the X.Org server to crash using a specially crafted XkbGetGeometry request. (CVE-2015-0255)

This issue was discovered by Olivier Fourdan of Red Hat.

All xorg-x11-server users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2015:0797 :

Updated xorg-x11-server packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A buffer over-read flaw was found in the way the X.Org server handled XkbGetGeometry requests. A malicious, authorized client could use this flaw to disclose portions of the X.Org server memory, or cause the X.Org server to crash using a specially crafted XkbGetGeometry request. (CVE-2015-0255)

This issue was discovered by Olivier Fourdan of Red Hat.

All xorg-x11-server users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated x11-server packages fix security vulnerabilities :

Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service (CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102).

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request, where the server trusts the client to send valid string lengths. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs.
This data is then available to the client via the XkbGetGeometry request. This can lead to information disclosure issues, as well as possibly a denial of service if a similar request can cause the server to crash (CVE-2015-0255).

xorg-x11-server has been updated to fix one security issue :

  - Check string lenghts in XkbSetGeometry request     (bnc#915810) This non-security issue has been fixed :.
    (CVE-2015-0255)

  - Option '-showopts' now works with all drivers     (bnc#883051)

tigervnc was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-0255: Information leak in the XkbSetGeometry     request of X servers (bnc#915810).

xorg-x11-server was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-0255: Information leak in the XkbSetGeometry     request of X servers (bnc#915810).

Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive information. (CVE-2015-0255)

It was discovered that the X.Org X server incorrectly handled certain trapezoids. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly crash the server. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-6424).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Hutterer reports :

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request.

The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory.

A similarly crafted request can likely cause the X server to crash.

Olivier Fourdan discovered that missing input validation in the Xserver's handling of XkbSetGeometry requests may result in an information leak or denial of service.

ID	Name	Product	Family	Severity
183619	Ubuntu 16.04 ESM : VNC4 vulnerabilities (USN-4772-1)	Nessus	Ubuntu Local Security Checks	high
84795	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2015 CPU)	Nessus	Misc.	high
84071	GLSA-201504-06 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
83855	SUSE SLED12 / SLES12 Security Update : tigervnc, fltk (SUSE-SU-2015:0939-1)	Nessus	SuSE Local Security Checks	medium
83690	SUSE SLED12 / SLES12 Security Update : xorg-x11-server (SUSE-SU-2015:0398-1)	Nessus	SuSE Local Security Checks	medium
83270	Amazon Linux AMI : xorg-x11-server (ALAS-2015-519)	Nessus	Amazon Linux Local Security Checks	medium
83190	Debian DLA-218-1 : xorg-server security update	Nessus	Debian Local Security Checks	medium
82759	Scientific Linux Security Update : xorg-x11-server on SL6.x, SL7.x i386/x86_64 (20150410)	Nessus	Scientific Linux Local Security Checks	medium
82714	CentOS 6 / 7 : xorg-x11-server (CESA-2015:0797)	Nessus	CentOS Local Security Checks	medium
82693	RHEL 6 / 7 : xorg-x11-server (RHSA-2015:0797)	Nessus	Red Hat Local Security Checks	medium
82690	Oracle Linux 6 / 7 : xorg-x11-server (ELSA-2015-0797)	Nessus	Oracle Linux Local Security Checks	medium
82372	Mandriva Linux Security Advisory : x11-server (MDVSA-2015:119)	Nessus	Mandriva Local Security Checks	medium
81643	SuSE 11.3 Security Update : xorg-x11-Xvnc (SAT Patch Number 10298)	Nessus	SuSE Local Security Checks	medium
81434	openSUSE Security Update : tigervnc (openSUSE-2015-170)	Nessus	SuSE Local Security Checks	medium
81433	openSUSE Security Update : xorg-x11-server (openSUSE-2015-169)	Nessus	SuSE Local Security Checks	medium
81398	Ubuntu 14.04 LTS : X.Org X server vulnerabilities (USN-2500-1)	Nessus	Ubuntu Local Security Checks	high
81332	FreeBSD : xorg-server -- Information leak in the XkbSetGeometry request of X servers. (54a69cf7-b2ef-11e4-b1f1-bcaec565249c)	Nessus	FreeBSD Local Security Checks	medium
81301	Debian DSA-3160-1 : xorg-server - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-0255

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium