Detections
Analytics

RHEL 2.1 : XFree86 (RHSA-2003:289)

critical Nessus Plugin ID 12424

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated XFree86 packages provide security fixes to font libraries and XDM.

XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. XDM is the X display manager.

Multiple integer overflows in the transfer and enumeration of font libraries in XFree86 allow local or remote attackers to cause a denial of service or execute arbitrary code via heap-based and stack-based buffer overflow attacks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0730 to this issue.

The risk to users from this vulnerability is limited because only clients can be affected by these bugs, however in some (non-default) configurations, both xfs and the X Server can act as clients to remote font servers.

XDM does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the pam_krb5 module. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0690 to this issue.

Users are advised to upgrade to these updated XFree86 4.1.0 packages, which contain backported security patches and are not vulnerable to these issues.

Solution

Update the affected packages.

See Also

https://access.redhat.com/security/cve/cve-2003-0690

https://access.redhat.com/security/cve/cve-2003-0730

https://access.redhat.com/errata/RHSA-2003:289

Plugin Details

Severity: Critical

ID: 12424

File Name: redhat-RHSA-2003-289.nasl

Version: 1.28

Type: local

Agent: unix

Published: 7/6/2004

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:xfree86, p-cpe:/a:redhat:enterprise_linux:xfree86-100dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-75dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-15-100dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-15-75dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-2-100dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-2-75dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-9-100dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-iso8859-9-75dpi-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-xnest, p-cpe:/a:redhat:enterprise_linux:xfree86-xvfb, p-cpe:/a:redhat:enterprise_linux:xfree86-cyrillic-fonts, p-cpe:/a:redhat:enterprise_linux:xfree86-devel, p-cpe:/a:redhat:enterprise_linux:xfree86-doc, p-cpe:/a:redhat:enterprise_linux:xfree86-libs, p-cpe:/a:redhat:enterprise_linux:xfree86-tools, p-cpe:/a:redhat:enterprise_linux:xfree86-twm, p-cpe:/a:redhat:enterprise_linux:xfree86-xdm, p-cpe:/a:redhat:enterprise_linux:xfree86-xf86cfg, p-cpe:/a:redhat:enterprise_linux:xfree86-xfs, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2003

Vulnerability Publication Date: 10/6/2003

Reference Information

CVE: CVE-2003-0690, CVE-2003-0730

BID: 8514, 8635

RHSA: 2003:289