3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
150 lines
6.2 KiB
Text
150 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:07 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: Multiple XFree86 3.3.6 vulnerabilities
|
|
|
|
Category: ports
|
|
Module: XFree86-3.3.6, XFree86-aoutlibs
|
|
Announced: 2001-01-23
|
|
Credits: Chris Evans <chris@ferret.lmh.ox.ac.uk>
|
|
Michal Zalewski <lcamtuf@tpi.pl>
|
|
Affects: Ports collection prior to the correction date.
|
|
Corrected: 2000-10-24 (XFree86-3.3.6)
|
|
Vendor status: Fixed in XFree86 4.0.1, no patches released by vendor.
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
XFree86 is a popular X server. It exists in three versions in the
|
|
FreeBSD ports collection: 3.3.6 and 4.0.2, as well as a.out libraries
|
|
based on XFree86 3.3.3.
|
|
|
|
II. Problem Description
|
|
|
|
The XFree86-3.3.6 port, versions prior to 3.3.6_1, has multiple
|
|
vulnerabilities that may allow local or remote users to cause a denial
|
|
of service attack against a vulnerable X server. Additionally, local
|
|
users may be able to obtain elevated privileges under certain
|
|
circumstances.
|
|
|
|
X server DoS:
|
|
Remote users can, by sending a malformed packet to port 6000 TCP,
|
|
cause the victim's X server to freeze for several minutes. During
|
|
the freeze, the mouse does not move and the screen does not update
|
|
in any way. In addition, the keyboard is unresponsive, including
|
|
console-switch and kill-server key combinations. Non-X processes,
|
|
such as remote command-line logins and non-X applications, are
|
|
unaffected by the freeze.
|
|
|
|
Xlib holes:
|
|
Due to various coding flaws in libX11, privileged (setuid/setgid)
|
|
programs linked against libX11 may allow local users to obtain
|
|
elevated privileges.
|
|
|
|
libICE DoS:
|
|
Due to inadequate bounds checking in libICE, a denial of service
|
|
exists with any application using libICE to listen on a network port
|
|
for network services.
|
|
|
|
The XFree86-aoutlibs port contains the XFree86 libraries from the
|
|
3.3.3 release of XFree86, in a.out format suitable for use with
|
|
applications in the legacy a.out binaryformat, most notably being the
|
|
FreeBSD native version of Netscape. It is unknown whether Netscape is
|
|
vulnerable to the problems described in this advisory, but it believed
|
|
that the only potential vulnerability is the libICE denial-of-service
|
|
condition described above.
|
|
|
|
The XFree86 and XFree86-aoutlibs ports are not installed by default
|
|
(although XFree86 is available as an installation option in the
|
|
FreeBSD installer), nor are they "part of FreeBSD" as such: they are
|
|
part of the FreeBSD ports collection, which contains almost 4500
|
|
third-party applications in a ready-to-install format. The ports
|
|
collections shipped with FreeBSD 3.5.1 and 4.1.1 contain these problem
|
|
since they were discovered after the releases, but the XFree86 problem
|
|
was corrected prior to the release of FreeBSD 4.2. At the time of
|
|
advisory release, the XFree86-aoutlibs port has not been corrected.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security
|
|
audit of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
Local or remote users may cause a denial of service attack against an
|
|
X server or certain X applications. Local users may obtain elevated
|
|
privileges with certain X applications.
|
|
|
|
If you have not chosen to install the XFree86 3.3.6 port/package or
|
|
the XFree86-aoutlibs port/package, or you are running XFree86 4.0.1 or
|
|
later, then your system is not vulnerable to this problem.
|
|
|
|
IV. Workaround
|
|
|
|
Deinstall the XFree86-3.3.6 and XFree86-aoutlibs ports/packages, if
|
|
you you have installed them.
|
|
|
|
Note that any statically linked binaries which make use of the
|
|
vulnerable XFree86 routines may still be vulnerable to the problems
|
|
after deinstallation of the port/package. However due to the
|
|
difficulty of developing a reliable scanning utility for such binaries
|
|
no such utility is provided.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your entire ports collection and rebuild the XFree86-3.3.6
|
|
port.
|
|
|
|
2) Deinstall the old package and install an XFree86-4.0.2 package
|
|
obtained from:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/x11/XFree86-4.0.2_5.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/x11/XFree86-4.0.2_5.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/x11/XFree86-4.0.2_5.tgz
|
|
|
|
[alpha]
|
|
Packages are not automatically generated for the alpha architecture at
|
|
this time due to lack of build resources.
|
|
|
|
NOTE: XFree86-3.3.6 packages are no longer made available, only the
|
|
newer XFree86-4.0.2 packages.
|
|
|
|
Note also that the XFree86-aoutlibs port has not yet been fixed: there
|
|
is currently no solution to the problem other than removing the
|
|
port/package and recompiling any dependent software to use ELF
|
|
libraries, or switching to an ELF-based version of the software, if
|
|
available (e.g. the BSD/OS or Linux versions of Netscape, as an
|
|
alternative to the FreeBSD native version). The potential impact of
|
|
the vulnerabilities to the local environment may be deemed not
|
|
sufficiently great to warrant this approach, however.
|
|
|
|
3) download a new port skeleton for the XFree86-3.3.6 port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOm3xpFUuHi5z0oilAQF+zQQAiwIQSv6MemATgo6v2/QwMjttGpbMxbh2
|
|
s94CK+aAlbtRlsrBZl6DIWwVydc1C3k6EHnM+NHqwhfOq/yrwp7JDKwVUmvi+5Qx
|
|
1UAY8QRu45OednLsyT2qUuNrowjMmkdB0EcsqQq2UvLtN2054m6AmpZk1t3TjGTr
|
|
CCOFX30qIn0=
|
|
=pI+q
|
|
-----END PGP SIGNATURE-----
|