Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote Solaris system is missing necessary patches to address security updates :

  - Use-after-free vulnerability in the doImageText function     in dix/dixfonts.c in the xorg-server module before     1.14.4 in X.Org X11 allows remote authenticated users to     cause a denial of service (daemon crash) or possibly     execute arbitrary code via a crafted ImageText request     that triggers memory-allocation failure. (CVE-2013-4396)

Fixes the following security issue :

  - an authenticated X client can cause an X server to use     memory after it was freed, potentially leading to crash     and/or memory corruption. (CVE-2013-4396, bnc#843652)     and the following bug was fixed too :

  - rfbAuthReenable is accessing rfbClient structure that     was in most cases already freed. It actually needs only     ScreenPtr, so pass it directly. (bnc#816813)

The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

xorg-x11-server was updated to fix the following security issue :

  - Fixed a security issue in which an authenticated X     client can cause an X server to use memory after it was     freed, potentially leading to crash and/or memory     corruption. (CVE-2013-4396, bnc#843652)

A non-security issues was also fixed :

  - rfbAuthReenable is accessing rfbClient structure that     was in most cases already freed. It actually needs only     ScreenPtr, so pass it directly. (bnc#816813)

A use-after-free flaw was found in the way the X.Org server handled ImageText requests. A malicious, authorized client could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2013-4396)

Updated x11-server packages fix security vulnerability :

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure (CVE-2013-4396).

Alan Coopersmith reports :

Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org security team in which an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption.

Pedro Ribeiro discovered a use-after-free in the handling of ImageText requests in the Xorg Xserver, which could result in denial of service or privilege escalation.

Pedro Ribeiro discovered that the X.Org X server incorrectly handled memory operations when handling ImageText requests. An attacker could use this issue to cause X.Org to crash, or to possibly execute arbitrary code. (CVE-2013-4396)

It was discovered that non-root X.Org X servers such as Xephyr incorrectly used cached xkb files. A local attacker could use this flaw to cause a xkb cache file to be loaded by another user, resulting in a denial of service. (CVE-2013-1056).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A use-after-free flaw was found in the way the X.Org server handled ImageText requests. A malicious, authorized client could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2013-4396)

Users of proprietary drivers may need to reinstall the driver after applying this update. Some users have reported the inability to load X without reloading the nVidia or the ATI drivers. You can use 'yum reinstall' to easily reload drivers packaged in RPM format. RPMs for many common drivers can be found at the ELRepo Project. You can easily add the ELRepo Project's repository to your system with 'yum install yum-conf-elrepo' on SL 6 systems. Any issues with ELRepo packages should be directed to their mailing lists.

After installing the update, X must be restarted for the changes to take full effect.

Updated xorg-x11-server packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A use-after-free flaw was found in the way the X.Org server handled ImageText requests. A malicious, authorized client could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2013-4396)

Red Hat would like to thank the X.Org security team for reporting this issue. Upstream acknowledges Pedro Ribeiro as the original reporter.

All xorg-x11-server users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1426 advisory.

    [1.13.0-11.1.2]
    - CVE-2013-4396: Fix use-after free in ImageText requests (#1014561)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New xorg-server packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue.

ID	Name	Product	Family	Severity
80821	Oracle Solaris Third-Party Patch Update : xorg (cve_2013_4396_use_after)	Nessus	Solaris Local Security Checks	medium
75179	openSUSE Security Update : xorg-x11-server (openSUSE-SU-2013:1610-1)	Nessus	SuSE Local Security Checks	medium
74028	GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
72288	AIX 7.1 TL 3 : xorg (IV53246)	Nessus	AIX Local Security Checks	medium
72287	AIX 6.1 TL 9 : xorg (IV52978)	Nessus	AIX Local Security Checks	medium
72070	AIX 5.3 TL 12 : xorg (IV53331)	Nessus	AIX Local Security Checks	medium
72069	AIX 7.1 TL 2 : xorg (IV52186)	Nessus	AIX Local Security Checks	medium
72068	AIX 7.1 TL 1 : xorg (IV52185)	Nessus	AIX Local Security Checks	medium
72067	AIX 6.1 TL 8 : xorg (IV52184)	Nessus	AIX Local Security Checks	medium
72066	AIX 6.1 TL 7 : xorg (IV52181)	Nessus	AIX Local Security Checks	medium
70961	SuSE 11.2 / 11.3 Security Update : xorg-x11-server (SAT Patch Numbers 8463 / 8464)	Nessus	SuSE Local Security Checks	medium
70896	Amazon Linux AMI : xorg-x11-server (ALAS-2013-234)	Nessus	Amazon Linux Local Security Checks	medium
70679	Mandriva Linux Security Advisory : x11-server (MDVSA-2013:259)	Nessus	Mandriva Local Security Checks	medium
70595	FreeBSD : xorg-server -- use-after-free (9a57c607-3cab-11e3-b4d9-bcaec565249c)	Nessus	FreeBSD Local Security Checks	medium
70548	Debian DSA-2784-1 : xorg-server - use-after-free	Nessus	Debian Local Security Checks	medium
70492	Ubuntu 12.04 LTS / 12.10 / 13.04 : xorg-server, xorg-server-lts-quantal, xorg-server-lts-raring vulnerabilities (USN-1990-1)	Nessus	Ubuntu Local Security Checks	medium
70468	Scientific Linux Security Update : xorg-x11-server on SL5.x, SL6.x i386/x86_64 (20131015)	Nessus	Scientific Linux Local Security Checks	medium
70464	CentOS 5 / 6 : xorg-x11-server (CESA-2013:1426)	Nessus	CentOS Local Security Checks	medium
70451	RHEL 5 / 6 : xorg-x11-server (RHSA-2013:1426)	Nessus	Red Hat Local Security Checks	medium
70450	Oracle Linux 5 / 6 : xorg-x11-server (ELSA-2013-1426)	Nessus	Oracle Linux Local Security Checks	critical
70441	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : xorg-server (SSA:2013-287-05)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2013-4396

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium