X.Org X Server Record Module and SECURITY Extension Multiple Heap Memory Corruption Vulnerabilities

Bugtraq ID:	29666
Class:	Input Validation Error
CVE:	CVE-2008-1377
Remote:	Yes
Local:	Yes
Published:	Jun 11 2008 12:00AM
Updated:	Mar 19 2015 08:20AM
Credit:	regenrecht
Vulnerable:	X.org xorg-server 1.4.1 X.org xorg-server 1.4 X.org xorg-server 1.3.99.2 (RC2) X.org xorg-server 1.2 X.org xorg-server 1.02-r5 X.org xorg-server 1.0.2-r6 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Sun OpenSolaris 0 Sun Java Desktop System (JDS) 2.0 Slackware Linux 12.1 Slackware Linux -current S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 1 Redhat Fedora 7 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 2.1 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 Redhat Application Server AS 3 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Enterprise Network Management System NoMachine nx-X11 3.1 -4 NoMachine nx-X11 3.1 -3 NoMachine NX Server 3.1 NoMachine NX Server 2.1 -18 NoMachine NX Server 2.1 -17 NoMachine NX Server 1.4 NoMachine NX Server 1.3.2 NoMachine NX Server 1.3.1 NoMachine NX Server 1.3 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 HP HP-UX B.11.31 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.11 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Voice Portal 3.0 Avaya Proactive Contact 4.0 Avaya Messaging Storage Server MM3.0 Avaya Message Networking 3.1 Avaya Intuity AUDIX LX 2.0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Avaya Interactive Response Avaya Integrated Management Avaya CVLAN Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 14.0 Avaya CMS Server 13.1 Attachmate Reflection X 14.0.5 Attachmate Reflection X 14.0 Attachmate Reflection X 13.0 Attachmate Reflection for UNIX and OpenVMS 14.0.5 Attachmate Reflection for IBM 14.0.5 Attachmate Reflection for IBM 14 Attachmate Reflection for HP 14.0.5 Attachmate Reflection 13.0.5 Attachmate Reflection 13.0.4 Attachmate Reflection 14.0 SP1 Attachmate Reflection 14.0 Attachmate Reflection 13.0
Not Vulnerable:	NoMachine NX Node 3.2 Attachmate Reflection X 14.1 Attachmate Reflection 14.1

X.Org X Server Record Module and SECURITY Extension Multiple Heap Memory Corruption Vulnerabilities

X.Org X Server is prone to multiple heap-based memory-corruption vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary code with superuser privileges or crash the affected application, denying service to legitimate users.

X.Org X Server Record Module and SECURITY Extension Multiple Heap Memory Corruption Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

X.Org X Server Record Module and SECURITY Extension Multiple Heap Memory Corruption Vulnerabilities

Solution:
The vendor has released an update and an advisory. Please see the references for more information.


X.org xorg-server 1.02-r5

• X.org xorg-xserver-1.4-cve-2008-1377.diff
  ftp://ftp.freedesktop.org/pub/xorg/X11R7.3/patches/xorg-xserver-1.4-cv e-2008-1377.diff

Sun Solaris 8_sparc

• Sun 119067-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119067-10-1

X.org xorg-server 1.0.2-r6

• X.org xorg-xserver-1.4-cve-2008-1377.diff
  ftp://ftp.freedesktop.org/pub/xorg/X11R7.3/patches/xorg-xserver-1.4-cv e-2008-1377.diff

X.org xorg-server 1.4

• X.org xorg-xserver-1.4-cve-2008-1377.diff
  ftp://ftp.freedesktop.org/pub/xorg/X11R7.3/patches/xorg-xserver-1.4-cv e-2008-1377.diff

X.org xorg-server 1.4.1

• X.org xorg-xserver-1.4-cve-2008-1377.diff
  ftp://ftp.freedesktop.org/pub/xorg/X11R7.3/patches/xorg-xserver-1.4-cv e-2008-1377.diff

X.Org X Server Record Module and SECURITY Extension Multiple Heap Memory Corruption Vulnerabilities

References:

• Multiple Vendor X Server Record and Security Extensions Multiple Memory Corrupti (iDefense Labs)
  
• SECURITY - X.org security alert along with the NX Node maintenance release (NoMachine)
  
• Technical Note 1708 Security Updates and Reflection (Attachmate)
  
• X.Org Homepage (X.Org)
  
• X.Org Security Page (X.Org)
  
• iDefense Security Advisory 06.11.08: Multiple Vendor X Server Record and Securit (iDefense Labs )
  
• ASA-2008-249 - Multiple security vulnerabilities in the Solaris X Server Extensi (Avaya)
  
• ASA-2008-274: xorg-x11 security update (RHSA-2008-0503) (Avaya)
  
• HPSBUX02381 SSRT080083 rev.1 - HP-UX Running Xserver, Remote Execution of Arbitr (HP)
  
• HPSBUX02381 SSRT080083 rev.2 - HP-UX Running Xserver, Remote Execution of Arbitr (HP)
  
• Nortel Response to Sun Alert 238686 - Multiple Security Vulnerabilities in the S (Nortel Networks)
  
• RHSA-2008:0502-3 XFree86 security update (Red Hat)
  
• RHSA-2008:0503-2 xorg-x11 security update (Red Hat)
  
• RHSA-2008:0504-3 xorg-x11-server security update (Red Hat)
  
• RHSA-2008:0512-3 XFree86 security update (Red Hat)
  
• Sun Alert 238686 Multiple security vulnerabilities in the Solaris X Server Exten (Sun Microsystems)
  
• X.Org security advisory june 2008 - Multiple vulnerabilities in X server extensi (X.Org)