X Server Extensions Memory Corruption Vulnerabilities
10 Jan. 2007
Summary
The X Window System is a graphical windowing system based on a client/server model.
Local exploitation of three different memory corruption vulnerabilities in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root.
Vulnerable Systems:
* X.Org server versions 7.1-1.1.0.
* Previous versions may also be affected.
Local exploitation of a memory corruption vulnerability in the "ProcRenderAddGlyphs" function lies within the Render extension. Insufficient input validation exists when allocating memory for glyph management data structures. (CVE-2006-6101)
Local exploitation of a memory corruption vulnerability in the "ProcDbeGetVisualInfo" function lies within the DBE extension. Insufficient input validation exists when allocating memory for data structures. (CVE-2006-6102)
Local exploitation of a memory corruption vulnerability in the "ProcDbeSwapBuffers" function lies within the DBE extension. Insufficient input validation exists when allocating memory for data structures. (CVE-2006-6103)
By sending a specially crafted X protocol request to specific extension, an attacker can cause an exploitable memory corruption condition.
Workaround:
Access to the vulnerable code can be prevented when the vulnerable extension is not built into the X binary. This can be accomplished by removing the entry for the DBE extension from your X server's configuration file, often stored in /etc/X11 and named xorg.conf or XF86Config-4. To do this, remove the following lines from the 'Module' section: Load "DBE"
Load "render"
This will prevent the render extension from loading, which may affect the appearance or operation of some applications.
