FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0946 Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

CVE-2008-1806 Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.

CVE-2008-1807 FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid 'number of axes' field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

CVE-2008-1808 Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer overflow.

  - Add freetype-2009-CVEs.patch

  - Resolves: #496111

  - Add freetype-2.3.5-CVEs.patch

  - Resolves: #450910

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0556 advisory.

    [2.2.1-20]
    - Add freetype-2.3.5-CVEs.patch
    - Resolves: #450910

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VMware Player, Server,       and Workstation. Please review the CVE identifiers referenced below for       details.
  Impact :

    Local users may be able to gain escalated privileges, cause a Denial of       Service, or gain sensitive information.
    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in the remote execution of arbitrary code, or a Denial       of Service. Remote attackers also may be able to spoof DNS traffic, read       arbitrary files, or inject arbitrary web script to the VMware Server       Console.
    Furthermore, guest OS users may be able to execute arbitrary code on the       host OS, gain escalated privileges on the guest OS, or cause a Denial of       Service (crash the host OS).
  Workaround :

    There is no known workaround at this time.

Multiple flaws were discovered in FreeType's Printer Font Binary (PFB) and TrueType Font (TTF) font-file format parsers. If a user loaded a carefully crafted font-file with a program linked against FreeType, it could cause the application to crash, or possibly execute arbitrary code. (CVE-2008-1806, CVE-2008-1807, CVE-2008-1808)

Note: the flaw in FreeType's TrueType Font (TTF) font-file format parser, covered by CVE-2008-1808, did not affect the freetype packages as shipped in Scientific Linux 3, 4, and 5, as they are not compiled with TTF Byte Code Interpreter (BCI) support.

I Security Issues

 a. Setting ActiveX kill bit

     Starting from this release, VMware has set the kill bit on its      ActiveX controls. Setting the kill bit ensures that ActiveX      controls cannot run in Internet Explorer (IE), and avoids      security issues involving ActiveX controls in IE. See the      Microsoft KB article 240797 and the related references on this      topic.

     Security vulnerabilities have been reported for ActiveX controls      provided by VMware when run in IE. Under specific circumstances,      exploitation of these ActiveX controls might result in denial-of-      service or can allow running of arbitrary code when the user      browses a malicious Web site or opens a malicious file in IE      browser. An attempt to run unsafe ActiveX controls in IE might      result in pop-up windows warning the user.
       Note: IE can be configured to run unsafe ActiveX controls without            prompting.  VMware recommends that you retain the default            settings in IE, which prompts when unsafe actions are            requested.

     Earlier, VMware had issued knowledge base articles, KB 5965318 and      KB 9078920 on security issues with ActiveX controls. To avoid      malicious scripts that exploit ActiveX controls, do not enable      unsafe ActiveX objects in your browser settings. As a best      practice, do not browse untrusted Web sites as an administrator      and do not click OK or Yes if prompted by IE to allow certain      actions.

     VMware would like to thank Julien Bachmann, Shennan Wang, Shinnai,      and Michal Bucko for reporting these issues to us.

     The Common Vulnerabilities and Exposures Project (cve.mitre.org)      has assigned the names CVE-2008-3691, CVE-2008-3692,      CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, CVE-2007-5438, and      CVE-2008-3696 to the security issues with VMware ActiveX controls.

 b. VMware ISAPI Extension Denial of Service

     The Internet Server Application Programming Interface (ISAPI) is      an API that extends the functionality of Internet Information      Server (IIS). VMware uses ISAPI extensions in its Server product.

     One of the ISAPI extensions provided by VMware is vulnerable to a      remote denial of service. By sending a malformed request, IIS      might shut down. IIS 6.0 restarts automatically. However, IIS 5.0      does not restart automatically when its Startup Type is set to      Manual.

     VMware would like to thank the Juniper Networks J-Security      Security Research Team for reporting this issue to us.

     The Common Vulnerabilities and Exposures Project (cve.mitre.org)      has assigned the name CVE-2008-3697 to this issue.

 c. OpenProcess Local Privilege Escalation on Host System

     This release fixes a privilege escalation vulnerability in host      systems.  Exploitation of this vulnerability allows users to run      arbitrary code on the host system with elevated privileges.

     VMware would like to thank Sun Bing from McAfee, Inc. for      reporting this issue to us.

     The Common Vulnerabilities and Exposures Project (cve.mitre.org)      has assigned the name CVE-2008-3698 to this issue.

 d. Update to Freetype

     FreeType 2.3.6 resolves an integer overflow vulnerability and other      vulnerabilities that can allow malicious users to run arbitrary code      or might cause a denial-of-service after reading a maliciously      crafted file. This release updates FreeType to 2.3.7.

     The Common Vulnerabilities and Exposures Project (cve.mitre.com)      has assigned the names CVE-2008-1806, CVE-2008-1807, and      CVE-2008-1808 to the issues resolved in Freetype 2.3.6.

 e. Update to Cairo

     Cairo 1.4.12 resolves an integer overflow vulnerability that can      allow malicious users to run arbitrary code or might cause a      denial-of-service after reading a maliciously crafted PNG file.
     This release updates Cairo to 1.4.14.

     The Common Vulnerabilities and Exposures (cve.mitre.com) has      assigned the name CVE-2007-5503 to this issue.

  f. VMware Consolidated Backup (VCB) command-line utilities may expose      sensitive information

     VMware Consolidated Backup command-line utilities accept the user      password through the -p command-line option. Users logged into the      ESX service console or into the system that runs VCB could gain      access to the username and password used by VCB command-line utilities      when such commands are running.

     The ESX patch and the new version of VCB resolve this issue by      providing an alternative way of passing the password used by VCB      command-line utilities.

     VCB in ESX
     ----------      The following options are recommended for passing the password :

     1. The password is specified in /etc/backuptools.conf      (PASSWORD=xxxxx), and -p is not used in the command line.
     /etc/backuptools.conf file permissions are read/write only      for root.

     2. No password is specified in /etc/backuptools.conf and the
     -p option is not used in the command line. The user will be       prompted to enter a password.

     ESX is not affected unless you use VCB.

     Stand-alone VCB
     ---------------      The following options are recommended for passing the password :

     1. The password is specified in config.js (PASSWORD=xxxxx), and -p      is not used in the command line. The file permissions on config.js      are read/write only for the administrator. The config.js file is      located in folder 'config' of the VCB installation folder. For example,      C:\Program Files\Vmware\Vmware Consolidated Backup Framework\config.

     2. The password is specified in the registry, and is not specified in      config.js, and -p is not used in the command line. Access to the      registry key holding the password is allowed only to the administrator.
     The location of the registry key is :
     On Windows x86: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\                      VMware Consolidated Backup\Password      On Windows x64: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\                      VMware, Inc.\VMware Consolidated Backup\Password

     3. The password is not specified in the registry, and is not specified in      config.js, and -p is not used in the command line. The user will be      prompted to enter a password.

     The Common Vulnerabilities and Exposures project (cve.mitre.org)      has assigned the name CVE-2008-2101 to this issue.

  g. Third-Party Library libpng Updated to 1.2.29

     Several flaws were discovered in the way third-party library      libpng handled various PNG image chunks. An attacker could      create a carefully crafted PNG image file in such a way that      it causes an application linked with libpng to crash when the      file is manipulated.

     The Common Vulnerabilities and Exposures project (cve.mitre.org)      has assigned the name CVE-2007-5269 to this issue.

     NOTE: There are multiple patches required to remediate the issue.

II ESX Service Console rpm updates

  a. update to bind

     This update upgrades the service console rpms for bind-utils and      bind-lib to version 9.2.4-22.el3.

     Version 9.2.4.-22.el3 addresses the recently discovered      vulnerability in the BIND software used for Domain Name      resolution (DNS). VMware doesn't install all the BIND packages      on ESX Server and is not vulnerable by default to the reported      vulnerability. Of the BIND packages, VMware only ships bind-util      and bind-lib in the service console and these components by      themselves cannot be used to setup a DNS server. Bind-lib and      bind-util are used in client DNS applications like nsupdate,      nslookup, etc.

     VMware explicitly discourages installing applications like BIND      on the service console. In case the customer has installed BIND,      and the DNS server is configured to support recursive queries,      their ESX Server system is affected and they should replace BIND      with a patched version.

     Note: ESX Server will use the DNS server on the network it is      on, so it is important to patch that DNS server.

     The Common Vulnerabilities and Exposures project (cve.mitre.org)      has assigned the name CVE-2008-1447 to this issue.

Multiple flaws were discovered in the PFB and TTF font handling code in freetype. If a user were tricked into using a specially crafted font file, a remote attacker could execute arbitrary code with user privileges or cause the application linked against freetype to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in FreeType's Printer Font Binary (PFB) font-file format parser. If a user were to load a carefully crafted font file with a program linked against FreeType, it could cause the application to crash or potentially execute arbitrary code (CVE-2008-1806, CVE-2008-1807, CVE-2008-1808).

The updated packages have been patched to prevent this issue.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

Several local vulnerabilities have been discovered in freetype, a FreeType 2 font engine, which could allow the execution of arbitrary code.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1806     An integer overflow allows context-dependent attackers     to execute arbitrary code via a crafted set of values     within the Private dictionary table in a Printer Font     Binary (PFB) file.

  - CVE-2008-1807     The handling of an invalid 'number of axes' field in the     PFB file could trigger the freeing of arbitrary memory     locations, leading to memory corruption.

  - CVE-2008-1808     Multiple off-by-one errors allowed the execution of     arbitrary code via malformed tables in PFB files, or     invalid SHC instructions in TTF files.

Secunia reports :

- An integer overflow error exists in the processing of PFB font files. This can be exploited to cause a heap-based buffer overflow via a PFB file containing a specially crafted 'Private' dictionary table.

- An error in the processing of PFB font files can be exploited to trigger the 'free()' of memory areas that are not allocated on the heap.

- An off-by-one error exists in the processing of PFB font files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted PFB file.

- An off-by-one error exists in the implementation of the 'SHC' instruction while processing TTF files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted TTF file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Updated freetype packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 25th June 2008] The original packages distributed with this errata had a bug which prevented freetype library from loading certain font files correctly. We have updated the packages to correct this bug.

FreeType is a free, high-quality, portable font engine that can open and manage font files, as well as efficiently load, hint and render individual glyphs.

Multiple flaws were discovered in FreeType's Printer Font Binary (PFB) and TrueType Font (TTF) font-file format parsers. If a user loaded a carefully crafted font-file with a program linked against FreeType, it could cause the application to crash, or possibly execute arbitrary code. (CVE-2008-1806, CVE-2008-1807, CVE-2008-1808)

Note: the flaw in FreeType's TrueType Font (TTF) font-file format parser, covered by CVE-2008-1808, only affected the FreeType 1 library (libttf), which shipped in the freetype packages in Red Hat Enterprise Linux 2.1. The FreeType 2 library (libfreetype) is not affected, as it is not compiled with TTF Byte Code Interpreter (BCI) support.

Users of freetype should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated freetype packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 25th June 2008] The original packages for Red Hat Enterprise Linux 3 and 4 distributed with this errata had a bug which prevented freetype library from loading certain font files correctly. We have updated the packages to correct this bug.

FreeType is a free, high-quality, portable font engine that can open and manage font files, as well as efficiently load, hint and render individual glyphs.

Multiple flaws were discovered in FreeType's Printer Font Binary (PFB) font-file format parser. If a user loaded a carefully crafted font-file with a program linked against FreeType, it could cause the application to crash, or possibly execute arbitrary code.
(CVE-2008-1806, CVE-2008-1807, CVE-2008-1808)

Note: the flaw in FreeType's TrueType Font (TTF) font-file format parser, covered by CVE-2008-1808, did not affect the freetype packages as shipped in Red Hat Enterprise Linux 3, 4, and 5, as they are not compiled with TTF Byte Code Interpreter (BCI) support.

Users of freetype should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200806-10 (FreeType: User-assisted execution of arbitrary code)

    Regenrecht reported multiple vulnerabilities in FreeType via iDefense:
    An integer overflow when parsing values in the Private dictionary table     in a PFB file, leading to a heap-based buffer overflow     (CVE-2008-1806).
    An invalid free() call related to parsing an invalid 'number of axes'     field in a PFB file (CVE-2008-1807).
    Multiple off-by-one errors when parsing PBF and TTF files, leading to     heap-based buffer overflows (CVE-2008-1808).
  Impact :

    A remote attacker could entice a user to open a specially crafted TTF     or PBF file, possibly resulting in the execution of arbitrary code with     the privileges of the user running an application linked against     FreeType (such as the X.org X server, running as root).
  Workaround :

    There is no known workaround at this time.

This update backports security fixes from upstream version 2.3.6 - CVE-2008-1806, CVE-2008-1807 and CVE-2008-1808. For further details, see:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=7 15 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=7 16 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=7 17 Note: TTF bytecode interpreter is not enabled by default in the Fedora freetype packages, therefore Fedora packages were not affected by the TTF part of the CVE-2008-1808.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79459	OracleVM 2.1 : freetype (OVMSA-2009-0012)	Nessus	OracleVM Local Security Checks	critical
67715	Oracle Linux 5 : freetype (ELSA-2008-0556)	Nessus	Oracle Linux Local Security Checks	high
62383	GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
60427	Scientific Linux Security Update : freetype on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
40382	VMSA-2008-0014 : Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.	Nessus	VMware ESX Local Security Checks	medium
37738	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : freetype vulnerabilities (USN-643-1)	Nessus	Ubuntu Local Security Checks	high
37537	Mandriva Linux Security Advisory : freetype2 (MDVSA-2008:121)	Nessus	Mandriva Local Security Checks	high
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
34163	Debian DSA-1635-1 : freetype - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
33419	FreeBSD : FreeType 2 -- Multiple Vulnerabilities (4fb43b2f-46a9-11dd-9d38-00163e000016)	Nessus	FreeBSD Local Security Checks	high
33250	RHEL 2.1 : freetype (RHSA-2008:0558)	Nessus	Red Hat Local Security Checks	high
33249	RHEL 3 / 4 / 5 : freetype (RHSA-2008:0556)	Nessus	Red Hat Local Security Checks	high
33246	GLSA-200806-10 : FreeType: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
33229	CentOS 3 / 4 / 5 : freetype (CESA-2008:0556)	Nessus	CentOS Local Security Checks	high
33222	Fedora 8 : freetype-2.3.5-4.fc8 (2008-5430)	Nessus	Fedora Local Security Checks	high
33221	Fedora 9 : freetype-2.3.5-6.fc9 (2008-5425)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-1807

critical

Tenable Plugins

critical

high

medium

high

medium

high

high

critical

high

high

high

high

high

high

high

high