Untrusted search path vulnerability in x11perfcomp in XFree86 x11perf before 1.5.4 allows local users to gain privileges via unspecified Trojan horse code in the current working directory.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - x11perfcomp has dot in its path (CVE-2011-2504)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - x11perfcomp has dot in its path (CVE-2011-2504)

  - The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the     existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently     if the file exists. (CVE-2011-4028)

  - The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the     permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed     execution permission) via a symlink attack on a temporary lock file. (CVE-2011-4029)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0502 advisory.

    - x11perf 1.5.4 (CVE-2011-2504)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that the x11perfcomp utility included the current working directory in its PATH environment variable. Running x11perfcomp in an attacker- controlled directory would cause arbitrary code execution with the privileges of the user running x11perfcomp. (CVE-2011-2504)

Also with this update, the xorg-x11-utils and xorg-x11-server-utils packages have been upgraded to upstream version 7.5, and the xorg-x11-apps package to upstream version 7.6, which provides a number of bug fixes and enhancements over the previous versions.

*xorg ABI change With this update there is a change in the X.org ABI for the video drivers. This change will require compatible drivers.
Anyone using the drivers shipped with SL should have no problems.
Anyone using drivers from an external source - such as nVidia, ATI, or ELRepo should ensure a compatible driver is loaded. Please ensure you are on the most recent compatible driver before updating the system.
--

Updated core client packages for the X Window System that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Core X11 clients packages provide the xorg-x11-utils, xorg-x11-server-utils, and xorg-x11-apps clients that ship with the X Window System.

It was found that the x11perfcomp utility included the current working directory in its PATH environment variable. Running x11perfcomp in an attacker-controlled directory would cause arbitrary code execution with the privileges of the user running x11perfcomp. (CVE-2011-2504)

Also with this update, the xorg-x11-utils and xorg-x11-server-utils packages have been upgraded to upstream version 7.5, and the xorg-x11-apps package to upstream version 7.6, which provides a number of bug fixes and enhancements over the previous versions. (BZ#835277, BZ#835278, BZ#835281)

All users of xorg-x11-utils, xorg-x11-server-utils, and xorg-x11-apps are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

ID	Name	Product	Family	Severity
198528	RHEL 5 : xorg-x11 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198488	RHEL 4 : xorg-x11 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
68742	Oracle Linux 6 : Core X11 clients (ELSA-2013-0502)	Nessus	Oracle Linux Local Security Checks	high
65563	Scientific Linux Security Update : Core X11 clients on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
65137	CentOS 6 : xorg-x11-apps / xorg-x11-server-utils / xorg-x11-utils (CESA-2013:0502)	Nessus	CentOS Local Security Checks	medium
64753	RHEL 6 : Core X11 clients (RHSA-2013:0502)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-2504

high

Tenable Plugins

critical

critical

high

medium

medium

medium