The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0031 advisory.

    [1.1.1-48.26.4.0.1]
     - Add Enterprise Linux detection

     [1.1.1-48.26.4]
     - cve-2007-5760.patch: XFree86-Misc Extension Invalid Array Index      Vulnerability
     - cve-2007-5958.patch: Xorg / XFree86 file existence disclosure      vulnerability
     - cve-2007-6427.patch: XInput Extension Memory Corruption Vulnerability
     - cve-2007-6428.patch: TOG-CUP Extension Memory Corruption Vulnerability
     - cve-2007-6429.patch: EVI and MIT-SHM Extension Integer Overflow      Vulnerability

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2008-0006)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

An integer and heap overflow flaw were found in the X.Org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

An input validation flaw was found in the X.org server's XFree86-Misc extension that could allow a malicious authorized client to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.org server (CVE-2007-5760).

A flaw was found in the X.org server's XC-SECURITY extension that could allow a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user (CVE-2007-5958).

A memory corruption flaw was found in the X.org server's XInput extension that could allow a malicious authorized client to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server (CVE-2007-6427).

An information disclosure flaw was found in the X.org server's TOG-CUP extension that could allow a malicious authorized client to cause a denial of service (crash) or potentially view arbitrary memory content within the X.org server's address space (CVE-2007-6428).

Two integer overflow flaws were found in the X.org server's EVI and MIT-SHM modules that could allow a malicious authorized client to cause a denial of service (crash) or potentially execute arbitrary code with the privileges of the X.org server (CVE-2007-6429).

The updated packages have been patched to correct these issues.

This update fixes various Xserver security issues.

  - File existence disclosure vulnerability. (CVE-2007-5958)

  - XInput Extension Memory Corruption Vulnerability     [IDEF2888 CVE-2007-6427].

  - TOG-CUP Extension Memory Corruption Vulnerability     [IDEF2901 CVE-2007-6428].

  - EVI Extension Integer Overflow Vulnerability [IDEF2902     CVE-2007-6429].

  - MIT-SHM Extension Integer Overflow Vulnerability     [IDEF2904 CVE-2007-6429].

  - XFree86-MISC Extension Invalid Array Index Vulnerability     [IDEF2903 CVE-2007-5760].

  - PCF font parser vulnerability.

X11 6.8.0: Xorg server patch.
Date this patch was last updated by Sun : Jul/13/15

Updated xorg-x11 packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 18th January 2008] The original packages distributed with this errata had a bug which could cause some X applications to fail on 32-bit platforms. We have updated the packages to correct this bug.

The xorg-x11 packages contain X.Org, an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2008-0006)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

An integer and heap overflow flaw were found in the X.Org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Users of xorg-x11 should upgrade to these updated packages, which contain backported patches to resolve these issues.

CVE-2007-5760: XFree86-Misc Extension Invalid Array Index Vulnerability CVE-2007-5958: Xorg / XFree86 file existence disclosure vulnerability CVE-2007-6427: XInput Extension Memory Corruption Vulnerability CVE-2007-6428: TOG-CUP Extension Memory Corruption Vulnerability CVE-2007-6429: EVI and MIT-SHM Extension Integer Overflow Vulnerability CVE-2008-0006: PCF Font Vulnerability - this patch isn't strictly required with new version of libXfont.

Contains updated fix for MITSHM from ajax.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200801-09 (X.Org X server and Xfont library: Multiple vulnerabilities)

    regenrecht reported multiple vulnerabilities in various X server     extension via iDefense:
    The XFree86-Misc extension does not properly sanitize a parameter     within a PassMessage request, allowing the modification of a function     pointer (CVE-2007-5760).
    Multiple functions in the XInput extension do not properly sanitize     client requests for swapping bytes, leading to corruption of heap     memory (CVE-2007-6427).
    Integer overflow vulnerabilities in the EVI extension and in the     MIT-SHM extension can lead to buffer overflows (CVE-2007-6429).
    The TOG-CUP extension does not sanitize an index value in the     ProcGetReservedColormapEntries() function, leading to arbitrary memory     access (CVE-2007-6428).
    A buffer overflow was discovered in the Xfont library when     processing PCF font files (CVE-2008-0006).
    The X server does not enforce restrictions when a user specifies a     security policy file and attempts to open it (CVE-2007-5958).
  Impact :

    Remote attackers could exploit the vulnerability in the Xfont library     by enticing a user to load a specially crafted PCF font file resulting     in the execution of arbitrary code with the privileges of the user     running the X server, typically root. Local attackers could exploit     this and the vulnerabilities in the X.org extensions to gain elevated     privileges. If the X server allows connections from the network, these     vulnerabilities could be exploited remotely. A local attacker could     determine the existence of arbitrary files by exploiting the last     vulnerability or possibly cause a Denial of Service.
  Workaround :

    Workarounds for some of the vulnerabilities can be found in the X.Org     security advisory as listed under References.

The X.org fix for CVE-2007-6429 introduced a regression in the MIT-SHM extension, which prevented the start of a few applications. This update provides updated packages for the xfree86 version included in Debian old stable (sarge) in addition to the fixed packages for Debian stable (etch), which were provided in DSA 1466-2.

For reference the original advisory text below :

Several local vulnerabilities have been discovered in the X.Org X server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5760     'regenrecht' discovered that missing input sanitising     within the XFree86-Misc extension may lead to local     privilege escalation.

  - CVE-2007-5958     It was discovered that error messages of security policy     file handling may lead to a minor information leak     disclosing the existence of files otherwise inaccessible     to the user.

  - CVE-2007-6427     'regenrecht' discovered that missing input sanitising     within the XInput-Misc extension may lead to local     privilege escalation.

  - CVE-2007-6428     'regenrecht' discovered that missing input sanitising     within the TOG-CUP extension may lead to disclosure of     memory contents.

  - CVE-2007-6429     'regenrecht' discovered that integer overflows in the     EVI and MIT-SHM extensions may lead to local privilege     escalation.

  - CVE-2008-0006     It was discovered that insufficient validation of PCF     fonts could lead to local privilege escalation.

ID	Name	Product	Family	Published	Updated	Severity
67636	Oracle Linux 5 : Important: / xorg-x11-server (ELSA-2008-0031)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
60347	Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
60348	Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
37567	Mandriva Linux Security Advisory : x11-server (MDVSA-2008:023)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	high
41182	SuSE9 Security Update : XFree86-libs (YOU Patch Number 12040)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
107437	Solaris 10 (sparc) : 125719-55	Nessus	Solaris Local Security Checks	3/12/2018	10/24/2025	high
30002	RHEL 4 : xorg-x11 (RHSA-2008:0030)	Nessus	Red Hat Local Security Checks	1/18/2008	1/14/2021	high
30073	Fedora 8 : xorg-x11-server-1.3.0.0-39.fc8 (2008-0760)	Nessus	Fedora Local Security Checks	1/27/2008	1/11/2021	high
30033	GLSA-200801-09 : X.Org X server and Xfont library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/21/2008	1/6/2021	high
30059	Debian DSA-1466-1 : xorg-server - several vulnerabilities	Nessus	Debian Local Security Checks	1/27/2008	1/4/2021	high
41183	SuSE9 Security Update : XFree86-Xnest (YOU Patch Number 12043)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high

high

high

high