xlockmore User Supplied Format String Vulnerability
BID:1585
Info
xlockmore User Supplied Format String Vulnerability
| Bugtraq ID: | 1585 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 15 2000 12:00AM |
| Updated: | Aug 15 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by bind <[email protected]> on August 15, 2000. |
| Vulnerable: |
David Bagley xlock 4.16.1 David Bagley xlock 4.16 |
| Not Vulnerable: | |
Exploit / POC
xlockmore User Supplied Format String Vulnerability
xlock -d %x%x%x%x%x
If this results in a message such as:
xlock: unable to open display dfbfd958402555e1ea748dfbfd958dfbfd654.
it is likely your system is vulnerable.
exploit tested on OpenBSD 2.6 i386:
xlock -d %x%x%x%x%x
If this results in a message such as:
xlock: unable to open display dfbfd958402555e1ea748dfbfd958dfbfd654.
it is likely your system is vulnerable.
exploit tested on OpenBSD 2.6 i386:
Solution / Fix
xlockmore User Supplied Format String Vulnerability
Solution:
Jeremy Buhler <[email protected]> has released a patch which eliminates this vulnerability and is now shipped with xlockmore 4.17.1 and later versions. The following is the relevant fixed code.
void
error(const char *buf)
{
#if defined( HAVE_SYSLOG_H ) && defined( USE_SYSLOG )
extern Display *dsp;
syslog(SYSLOG_WARNING, "%s", buf);
if (!nolock) {
if (strstr(buf, "unable to open display") == NULL)
syslogStop(XDisplayString(dsp));
else
syslogStop("unknown display");
closelog();
}
#else
(void) fprintf(stderr, "%s", buf);
#endif
exit(1);
}
Patches are available for Debian Linux 2.1 and 2.2.
Patches are available for the FreeBSD ports version of xlockmore.
David Bagley xlock 4.16
David Bagley xlock 4.16.1
Solution:
Jeremy Buhler <[email protected]> has released a patch which eliminates this vulnerability and is now shipped with xlockmore 4.17.1 and later versions. The following is the relevant fixed code.
void
error(const char *buf)
{
#if defined( HAVE_SYSLOG_H ) && defined( USE_SYSLOG )
extern Display *dsp;
syslog(SYSLOG_WARNING, "%s", buf);
if (!nolock) {
if (strstr(buf, "unable to open display") == NULL)
syslogStop(XDisplayString(dsp));
else
syslogStop("unknown display");
closelog();
}
#else
(void) fprintf(stderr, "%s", buf);
#endif
exit(1);
}
Patches are available for Debian Linux 2.1 and 2.2.
Patches are available for the FreeBSD ports version of xlockmore.
David Bagley xlock 4.16
-
MandrakeSoft 7.0 i386 xlockmore-4.17.1-1mdk.i586.rpm
ftp://ftp.linux.tucows.com/pub/distributions/Mandrake/Mandrake/updates /7.0/RPMS/xlockmore-4.17.1-1mdk.i586.rpm -
MandrakeSoft 7.1 i386 xlockmore-4.17.1-1mdk.i586.rpm
ftp://ftp.linux.tucows.com/pub/distributions/Mandrake/Mandrake/updates /7.1/RPMS/xlockmore-4.17.1-1mdk.i586.rpm
David Bagley xlock 4.16.1
-
MandrakeSoft 7.0 i386 xlockmore-4.17.1-1mdk.i586.rpm
ftp://ftp.linux.tucows.com/pub/distributions/Mandrake/Mandrake/updates /7.0/RPMS/xlockmore-4.17.1-1mdk.i586.rpm -
MandrakeSoft 7.1 i386 xlockmore-4.17.1-1mdk.i586.rpm
ftp://ftp.linux.tucows.com/pub/distributions/Mandrake/Mandrake/updates /7.1/RPMS/xlockmore-4.17.1-1mdk.i586.rpm