===================================================================== CERT-Renater Note d'Information No. 2007/VULN022 _____________________________________________________________________ DATE : 26/01/2007 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Xorg X server. ====================================================================== Sun(sm) Alert Notification * Sun Alert ID: 102780 * Synopsis: Two Integer Overflow Vulnerabilities Found in the Xorg(1) X Server * Category: Security * Product: Solaris 9 Operating System, Solaris 10 Operating System * BugIDs: 6464170, 6464172 * Avoidance: Patch, Workaround * State: Workaround * Date Released: 23-Jan-2007 * Date Closed: * Date Modified: 1. Impact Two integer overflows, one in the CIDAFM() function and one in the scan_cidfont() function, have been found in the Xorg X server (see Xorg(1)) which may allow a local unprivileged user the ability to execute arbitrary code with the privileges of the Xorg server. The Xorg X server runs with root privileges on Solaris. These issues are described in the following documents: CVE-2006-3739 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3739 CVE-2006-3740 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3740 iDefense Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow Vulnerability at: http://www.idefense.com/intelligence/vulnerabilities/display.php?id =412 Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont()' Integer Overflow Vulnerability at: http://www.idefense.com/intelligence/vulnerabilities/display.php?id =411 2. Contributing Factors These issues can occur in the following releases: x86 Platform * Solaris 9 * Solaris 10 without patch 119062-02 Notes: 1. Solaris 8 on the x86 platform is not affected by this issue. 2. Solaris 8, 9 and 10 on the SPARC platform are not affected by this issue. 3. Solaris 9 on the x86 platform does not ship with the Xorg X server by default but is present if the unbundled Sun Java Desktop System (JDS) Release 2 was downloaded and installed. To determine if JDS Release 2 is installed on a Solaris 9 x86 system, the following command can be run: $ grep distributor-version /usr/share/gnome-about/gnome-version.xml Sun Java Desktop System, Release 2 4. The described issues only occur on systems with the SUNWxorg packages installed. To determine if the SUNWxorg packages are installed on the system, the following command can be used: $ pkginfo SUNWxorg-server system SUNWxorg-server X.Org Foundation Xserver 3. Symptoms There are no predictable symptoms that would indicate the described issues have been exploited to execute arbitrary commands with root privileges. 4. Relief/Workaround To work around the described issues until the patch can be applied, the following entry for the Type 1 font module can be removed or commented out (by inserting a '#' at the beginning line) from the xorg.conf(4) file: Load "type1" Note: After applying this workaround, applications which require Type 1 fonts may not display the text properly. 5. Resolution These issues are addressed in the following release: x86 Platform * Solaris 10 with patch 119062-02 or later A final resolution for Solaris 9 (x86) is pending completion. This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================