X.Org X Server Composite Extension Local Buffer Overflow Vulnerability

Bugtraq ID:	25606
Class:	Boundary Condition Error
CVE:	CVE-2007-4730
Remote:	No
Local:	Yes
Published:	Sep 06 2007 12:00AM
Updated:	May 09 2008 07:15PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	X.org xorg-server 1.3.99.2 (RC2) Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise Desktop 10 SP1 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Linux Enterprise Server 10.SP1 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc rPath rPath Linux 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Desktop 4.0 Red Hat Enterprise Linux AS 4 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Messaging Storage Server MSS 3.0 Avaya Message Networking MN 3.1 Avaya Message Networking Avaya Intuity LX 2.0 Avaya Intuity LX
Not Vulnerable:	X.org xorg-server 1.4

X.Org X Server Composite Extension Local Buffer Overflow Vulnerability

The X.Org X Window System is prone to a local buffer-overflow vulnerability.

A local attacker can exploit this issue to execute arbitrary code with elevated privileges. This may facilitate a compromise of the affected computer.

X.Org X Server Composite Extension Local Buffer Overflow Vulnerability

A commercial exploit has been released for Core IMPACT.

X.Org X Server Composite Extension Local Buffer Overflow Vulnerability

Solution:
X.Org xorg-server 1.4 addresses this issue. Please see the vendor references for more information.


X.org xorg-server 1.3.99.2 (RC2)

• X.org X.Org xorg-server 1.4 source code
  http://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.4 .tar.gz

X.Org X Server Composite Extension Local Buffer Overflow Vulnerability

References:

• [ANNOUNCE] xorg-server 1.4 (X.Org)
  
• XOrg Homepage (XOrg)
  
• ASA-2007-394 Xorg-x11 security update (RHSA-2007-0898) (Avaya)
  
• RHSA-2007:0898-3 xorg-x11 security update (Red Hat)