XFree86 fbglyph Denial of Service Vulnerability

Bugtraq ID:	3657
Class:	Boundary Condition Error
CVE:	CVE-2001-0955
Remote:	No
Local:	Yes
Published:	Dec 08 2001 12:00AM
Updated:	Jul 11 2009 09:06AM
Credit:
Vulnerable:	XFree86 X11R6 4.0.3 + Redhat Linux 7.1 XFree86 X11R6 4.0.1 + Redhat Linux 7.0 XFree86 X11R6 4.0
Not Vulnerable:	XFree86 X11R6 4.1 .0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 i386 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0

XFree86 fbglyph Denial of Service Vulnerability

XFree86 4.x is vulnerable to a potential memory corruption / buffer overflow attack. This vulnerability has been demonstrated using the KDE Web Browser / File Management application "Konqueror", and represents at the very least a denial of service. This may also indicate an exploitable buffer overflow that could be used by an attacker to gain privileges on the machine running the X server, and may or may not be remotely exploitable (depending on which applications expose it). This is a vulnerability in the XFree86 server itself and not the client applications that can be used to initiate it. This has been reported under the following circumstances:

1. When the Konqueror browser processes excessively long strings in the actual browser window (ie, pasting these to a remote site from within the browser).
2. Double clicking on excessively long filenames in the file manager of Konqueror

Linux and other systems may be compromised if this vulnerability is successfully exploited to execute arbitrary code.

XFree86 fbglyph Denial of Service Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

XFree86 fbglyph Denial of Service Vulnerability

Solution:
A patch is available:

Index: fbglyph.c
===================================================================
RCS file: /xf86/xc/programs/Xserver/fb/fbglyph.c,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- fbglyph.c 2001/05/29 04:54:09 1.11
+++ fbglyph.c 2001/09/07 15:16:00 1.12
@@ -34,9 +34,19 @@
int height)
{
BoxRec box;
+ BoxPtr pExtents = REGION_EXTENTS (0, pRegion);

- if (x + width < 0) return FALSE;
- if (y + height < 0) return FALSE;
+ /*
+ * Check extents by hand to avoid 16 bit overflows
+ */
+ if (x < (int) pExtents->x1)
+ return FALSE;
+ if ((int) pExtents->x2 < x + width)
+ return FALSE;
+ if (y < (int) pExtents->y1)
+ return FALSE;
+ if ((int) pExtents->y2 < y + height)
+ return FALSE;
box.x1 = x;
box.x2 = x + width;
box.y1 = y;
@@ -261,10 +271,10 @@
FbBits,
int,
int);
- FbBits *dst;
- FbStride dstStride;
- int dstBpp;
- int dstXoff, dstYoff;
+ FbBits *dst = 0;
+ FbStride dstStride = 0;
+ int dstBpp = 0;
+ int dstXoff = 0, dstYoff = 0;

glyph = 0;
if (pGC->fillStyle == FillSolid && pPriv->and == 0)
@@ -352,10 +362,10 @@
FbBits,
int,
int);
- FbBits *dst;
- FbStride dstStride;
- int dstBpp;
- int dstXoff, dstYoff;
+ FbBits *dst = 0;
+ FbStride dstStride = 0;
+ int dstBpp = 0;
+ int dstXoff = 0, dstYoff = 0;

glyph = 0;
if (pPriv->and == 0)

XFree86 fbglyph Denial of Service Vulnerability

References:

• Konqueror Web Page (Konqueror)
  
• XFree86 Homepage (XFree86)