Multiple Vendor X Font Server Remote Buffer Overrun Vulnerability

Bugtraq ID:	6241
Class:	Boundary Condition Error
CVE:	CVE-2002-1317
Remote:	Yes
Local:	No
Published:	Nov 25 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovered by Neel Mehta of ISS X-Force.
Vulnerable:	XFree86 X11R6 3.3.5 - Redhat Linux 6.1 i386 XFree86 X11R6 3.3.4 XFree86 X11R6 3.3.3 XFree86 X11R6 3.3.2 + Mandriva Linux Mandrake 8.0 XFree86 X11R6 3.3 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 9_x86 Update 2 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 5.2 IBM AIX 5.1 HP HP-UX 11.22 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.24 HP HP-UX 10.20 HP HP-UX 10.10
Not Vulnerable:	XFree86 X11R6 4.2.1 + Immunix Immunix OS 7.3 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Redhat Linux 7.3 + Slackware Linux 8.1 XFree86 X11R6 4.2 .0 + Conectiva Linux Enterprise Edition 1.0 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Workstation 8.0 XFree86 X11R6 4.1 .0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 i386 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0 XFree86 X11R6 4.0.3 + Redhat Linux 7.1 XFree86 X11R6 4.0.1 + Redhat Linux 7.0 XFree86 X11R6 4.0 XFree86 X11R6 3.3.6 + Debian Linux 2.2 + Redhat Linux 6.2 SGI IRIX 6.5.19 SGI IRIX 6.5.18 SGI IRIX 6.5.17 SGI IRIX 6.5.16 SGI IRIX 6.5.15 SGI IRIX 6.5.14

Multiple Vendor X Font Server Remote Buffer Overrun Vulnerability

A remotely exploitable buffer overrun condition has been reported in the XFS font server, fs.auto used by multiple vendors. This vulnerability may be exploited by remote attackers to execute commands on the target host with privileges of user nobody.

This vulnerability has been reported fixed in XFree86 3.3.6 and later.

Multiple Vendor X Font Server Remote Buffer Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

• /data/vulnerabilities/exploits/7350ippi

Multiple Vendor X Font Server Remote Buffer Overrun Vulnerability

References:

• 48879 (Sun Microsystems)
  
• MSS-OAR-E01-2003:1601.1 xfs buffer overflow vulnerability (IBM)
  
• Solaris fs.auto Remote Compromise Vulnerability (ISS)
  
• Re: ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability (Florian Weimer )