Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xfs heap overflow in the swap_char2b function (CVE-2007-4990)

  - Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-     dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol     requests with crafted size values, which triggers a heap-based buffer overflow. (CVE-2007-4568)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

From Red Hat Security Advisory 2008:0030 :

Updated xorg-x11 packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 18th January 2008] The original packages distributed with this errata had a bug which could cause some X applications to fail on 32-bit platforms. We have updated the packages to correct this bug.

The xorg-x11 packages contain X.Org, an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2008-0006)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

An integer and heap overflow flaw were found in the X.Org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Users of xorg-x11 should upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2008:0029 :

Updated XFree86 packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 18th January 2008] The original packages distributed with this errata had a bug which could cause some X applications to fail on 32-bit platforms. We have updated the packages to correct this bug.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

Two integer overflow flaws were found in the XFree86 server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the XFree86 server handled malformed font files. A malicious local user could exploit this issue to potentially execute arbitrary code with the privileges of the XFree86 server. (CVE-2008-0006)

A memory corruption flaw was found in the XFree86 server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server. (CVE-2007-6427)

An information disclosure flaw was found in the XFree86 server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the XFree86 server's address space.
(CVE-2007-6428)

An integer and heap overflow flaw were found in the X.org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the XFree86 server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Users of XFree86 are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Two integer overflow flaws were found in the XFree86 server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the XFree86 server handled malformed font files. A malicious local user could exploit this issue to potentially execute arbitrary code with the privileges of the XFree86 server. (CVE-2008-0006)

A memory corruption flaw was found in the XFree86 server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server. (CVE-2007-6427)

An information disclosure flaw was found in the XFree86 server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the XFree86 server's address space.
(CVE-2007-6428)

An integer and heap overflow flaw were found in the X.org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the XFree86 server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2008-0006)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

An integer and heap overflow flaw were found in the X.Org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Updated xorg-x11 packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 18th January 2008] The original packages distributed with this errata had a bug which could cause some X applications to fail on 32-bit platforms. We have updated the packages to correct this bug.

The xorg-x11 packages contain X.Org, an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2008-0006)

A memory corruption flaw was found in the X.Org server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-6427)

An input validation flaw was found in the X.Org server's XFree86-Misc extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the X.Org server. (CVE-2007-5760)

An information disclosure flaw was found in the X.Org server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the X server's address space. (CVE-2007-6428)

An integer and heap overflow flaw were found in the X.Org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the X.Org server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Users of xorg-x11 should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

 The remote host is running a version of Mac OS X that is older than version 10.5.2. Mac OS X 10.5.2 contains several security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.2.

Mac OS X 10.5.2 contains several security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-001 applied. 

This update contains several security fixes for a number of programs.

Updated XFree86 packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 18th January 2008] The original packages distributed with this errata had a bug which could cause some X applications to fail on 32-bit platforms. We have updated the packages to correct this bug.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

Two integer overflow flaws were found in the XFree86 server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2007-6429)

A heap based buffer overflow flaw was found in the way the XFree86 server handled malformed font files. A malicious local user could exploit this issue to potentially execute arbitrary code with the privileges of the XFree86 server. (CVE-2008-0006)

A memory corruption flaw was found in the XFree86 server's XInput extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially execute arbitrary code with root privileges on the XFree86 server. (CVE-2007-6427)

An information disclosure flaw was found in the XFree86 server's TOG-CUP extension. A malicious authorized client could exploit this issue to cause a denial of service (crash), or potentially view arbitrary memory content within the XFree86 server's address space.
(CVE-2007-6428)

An integer and heap overflow flaw were found in the X.org font server, xfs. A user with the ability to connect to the font server could have been able to cause a denial of service (crash), or potentially execute arbitrary code with the permissions of the font server.
(CVE-2007-4568, CVE-2007-4990)

A flaw was found in the XFree86 server's XC-SECURITY extension, that could have allowed a local user to verify the existence of an arbitrary file, even in directories that are not normally accessible to that user. (CVE-2007-5958)

Users of XFree86 are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

This update fixes the following issues :

X Font Server build_range() Integer Overflow Vulnerability [IDEF2708] (CVE-2007-4989), X Font Server swap_char2b() Heap Overflow Vulnerability [IDEF2709] (CVE-2007-4990), Composite extension buffer overflow. (CVE-2007-4730)

- Bug #373261 - CVE-2007-4568 xfs integer overflow in the     build_range function [f7]

  - Bug #373331 - CVE-2007-4990 xfs heap overflow in the     swap_char2b function [f7]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow. (CVE-2007-4568)

The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption. (CVE-2007-4990)

Updated package fixes these issues.

The remote host is affected by the vulnerability described in GLSA-200710-11 (X Font Server: Multiple Vulnerabilities)

    iDefense reported that the xfs init script does not correctly handle a     race condition when setting permissions of a temporary file     (CVE-2007-3103). Sean Larsson discovered an integer overflow     vulnerability in the build_range() function possibly leading to a     heap-based buffer overflow when handling 'QueryXBitmaps' and     'QueryXExtents' protocol requests (CVE-2007-4568). Sean Larsson also     discovered an error in the swap_char2b() function possibly leading to a     heap corruption when handling the same protocol requests     (CVE-2007-4990).
  Impact :

    The first issue would allow a local attacker to change permissions of     arbitrary files to be world-writable by performing a symlink attack.
    The second and third issues would allow a local attacker to execute     arbitrary code with privileges of the user running the X Font Server,     usually xfs.
  Workaround :

    There is no known workaround at this time.

Sean Larsson discovered that two code paths inside the X Font Server handle integer values insecurely, which may lead to the execution of arbitrary code.

Matthieu Herrb reports : Problem Description : Several vulnerabilities have been identified in xfs, the X font server. The QueryXBitmaps and QueryXExtents protocol requests suffer from lack of validation of their 'length' parameters. Impact : On most modern systems, the font server is accessible only for local clients and runs with reduced privileges, but on some systems it may still be accessible from remote clients and possibly running with root privileges, creating an opportunity for remote privilege escalation.

ID	Name	Product	Family	Severity
198353	RHEL 5 : xorg-x11-xfs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
67635	Oracle Linux 4 : xorg-x11 (ELSA-2008-0030)	Nessus	Oracle Linux Local Security Checks	high
67634	Oracle Linux 3 : XFree86 (ELSA-2008-0029)	Nessus	Oracle Linux Local Security Checks	high
60349	Scientific Linux Security Update : XFree86 on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60347	Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43667	CentOS 4 : xorg-x11 (CESA-2008:0030)	Nessus	CentOS Local Security Checks	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
4373	Mac OS X < 10.5.2 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
30255	Mac OS X 10.5.x < 10.5.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
30254	Mac OS X Multiple Vulnerabilities (Security Update 2008-001)	Nessus	MacOS X Local Security Checks	critical
30022	CentOS 3 : XFree86 (CESA-2008:0029)	Nessus	CentOS Local Security Checks	high
30002	RHEL 4 : xorg-x11 (RHSA-2008:0030)	Nessus	Red Hat Local Security Checks	high
30001	RHEL 2.1 / 3 : XFree86 (RHSA-2008:0029)	Nessus	Red Hat Local Security Checks	high
29603	SuSE 10 Security Update : X.org X11 (ZYPP Patch Number 4485)	Nessus	SuSE Local Security Checks	high
29278	Fedora 7 : xorg-x11-xfs-1.0.5-1.fc7 (2007-4263)	Nessus	Fedora Local Security Checks	high
27817	Mandrake Linux Security Advisory : xfs (MDKSA-2007:210)	Nessus	Mandriva Local Security Checks	high
27046	GLSA-200710-11 : X Font Server: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
26976	Debian DSA-1385-1 : xfs - several vulnerabilities	Nessus	Debian Local Security Checks	medium
26939	FreeBSD : xfs -- multiple vulnerabilities (a5f667db-7596-11dc-8b7a-0019b944b34e)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-4568

critical

Tenable Plugins

critical

high

high

high

high

high

critical

critical

critical

critical

high

high

high

high

high

high

high

medium

medium