X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

The remote host is affected by the vulnerability described in GLSA-200704-22 (BEAST: Denial of Service)

    BEAST, which is installed as setuid root, fails to properly check     whether it can drop privileges accordingly if seteuid() fails due to a     user exceeding assigned resource limits.
  Impact :

    A local user could exceed his resource limit in order to prevent the     seteuid() call from succeeding. This may lead BEAST to keep running     with root privileges. Then, the local user could use the 'save as'     dialog box to overwrite any file on the vulnerable system, potentially     leading to a Denial of Service.
  Workaround :

    There is no known workaround at this time.

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

In practice, it is unlikely that these programs have any real-world vulnerability. The X binary is the only one shipped suid. Further analysis of the code in question shows that it's highly unlikely that this can be exploited. Patched updates are provided as a precaution nonetheless.

Updated packages are patched to address this issue.

Several vulnerabilities have been discovered in the X Window System, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3467     Chris Evan discovered an integer overflow in the code to     handle PCF fonts, which might lead to denial of service     if a malformed font is opened.

  - CVE-2006-3739     It was discovered that an integer overflow in the code     to handle Adobe Font Metrics might lead to the execution     of arbitrary code.

  - CVE-2006-3740     It was discovered that an integer overflow in the code     to handle CMap and CIDFont font data might lead to the     execution of arbitrary code.

  - CVE-2006-4447     The XFree86 initialization code performs insufficient     checking of the return value of setuid() when dropping     privileges, which might lead to local privilege     escalation.

The remote host is affected by the vulnerability described in GLSA-200608-25 (X.org and some X.org libraries: Local privilege escalations)

    Several X.org libraries and X.org itself contain system calls to     set*uid() functions, without checking their result.
  Impact :

    Local users could deliberately exceed their assigned resource limits     and elevate their privileges after an unsuccessful set*uid() system     call. This requires resource limits to be enabled on the machine.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
25110	GLSA-200704-22 : BEAST: Denial of Service	Nessus	Gentoo Local Security Checks	high
23904	Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2006:160)	Nessus	Mandriva Local Security Checks	high
22734	Debian DSA-1193-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	high
22287	GLSA-200608-25 : X.org and some X.org libraries: Local privilege escalations	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2006-4447

high

Tenable Plugins

high

high

high

high