Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
BID:884
Info
Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
| Bugtraq ID: | 884 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 20 1999 12:00AM |
| Updated: | Dec 20 1999 12:00AM |
| Credit: | This information was published in an SCO bug status report posted to Bugtraq by Michael Almond <[email protected]> on Dec 20, 1999. An IRIX exploit dated November, 1998 was recently discovered. |
| Vulnerable: |
SGI IRIX 6.2 SCO Open Server 5.0.5 |
| Not Vulnerable: | |
Discussion
Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
SCO Openserver and SGI IRIX (6.2 confirmed, possibly others) are vulnerable to several buffer overflows in various shared libraries related to the X window system. This means that all programs which link to these libraries could be vulnerable to exploitation through buggy library calls. The vulnerable libraries are:
LibX11
LibXt
LibXaw
LibXmu
This vulnerability may be similar to serious X library overflows, in our database as Bugtraq ID 237 (published in August, 1997) and the Sun X problems archived in our database as Bugtraq ID 238 (published in May, 1999).
SCO Openserver and SGI IRIX (6.2 confirmed, possibly others) are vulnerable to several buffer overflows in various shared libraries related to the X window system. This means that all programs which link to these libraries could be vulnerable to exploitation through buggy library calls. The vulnerable libraries are:
LibX11
LibXt
LibXaw
LibXmu
This vulnerability may be similar to serious X library overflows, in our database as Bugtraq ID 237 (published in August, 1997) and the Sun X problems archived in our database as Bugtraq ID 238 (published in May, 1999).
Exploit / POC
Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
The following exploit was recently uncovered on the "Last Stage of Delirium" web site, lsd-pl.net
The following exploit was recently uncovered on the "Last Stage of Delirium" web site, lsd-pl.net
Solution / Fix
Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Multiple Vendor LibX11/X11 Toolkit/Athena Widget Library Buffer Overflows Vulnerability
References:
References: