__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Red Hat Updated XFree86 Packages Provide Security and Bug Fixes [Red Hat Security Advisory RHSA-2003:067-16] June 25, 2003 21:00 GMT Number N-110 [REVISED 28 July 2003] ______________________________________________________________________________ PROBLEM: There are a number of security vulnerabilities in XFree86: * Xterm - An attacker can craft an escape sequence that sets the victim's Xterm window title to an arbitrary command, and then reports it to the command line. * It is possible to lock up versions of Xterm by sending an invalid DEC UDK escape sequence. * The xdm display manager, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist. * XFree86 4.2.1 has a vulnerability in the MIT-SHM extension of the X server that allows local users to read and write arbitrary shared memory. * The X server was setting the /dev/dri directory permissions incorrectly, which resulted in the directory being world writable. * Numerous driver updates and fixes. SOFTWARE: Red Hat Linux 7.1 Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 DAMAGE: The most serious of these vulnerabilities may allow an attacker to run arbitrary commands on the command line. SOLUTION: Apply patches as stated in Red Hat's security advisories. ______________________________________________________________________________ VULNERABILITY The risk is LOW. A local account to a machine is required to ASSESSMENT: launch this type of attack. An attacker will have to entice a user to press Enter for the shell to process the title as a command. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-110.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2003-067.html ADDITIONAL LINKS: RED HAT LINUX 7.1 & 7.2 - https://rhn.redhat.com/errata/RHSA-2003-064.html RED HAT LINUX 7.3 - https://rhn.redhat.com/errata/RHSA-2003-066.html SUN LINUX 5.0 and SRPM fixes - http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert% 2F55602&zone_32=category%3Asecurity ______________________________________________________________________________ REVISION HISTORY: 7/28/2003 - Added link to Sun's Alert #55602. [***** Start Red Hat Security Advisory RHSA-2003:067-16 *****] Updated XFree86 packages provide security and bug fixes Advisory: RHSA-2003:067-16 Last updated on: 2003-06-25 Affected Products: Red Hat Linux 8.0 CVEs (cve.mitre.org): CAN-2001-1409 CAN-2002-0164 CAN-2002-1472 CAN-2003-0063 CAN-2003-0071 Security Advisory Details: Updated XFree86 packages for Red Hat Linux 8.0 are now available which include several security fixes, bug fixes, enhancements, and driver updates. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers in Red Hat Linux. A number of security vulnerabilities have been discovered in XFree86 4.2.0: - Xterm, provided as part of the XFree86 packages, provides an escape sequence for reporting the current window title. This escape sequence essentially takes the current title and places it directly on the command line. An attacker can craft an escape sequence that sets the victim's Xterm window title to an arbitrary command, and then reports it to the command line. Since it is not possible to embed a carriage return into the window title, the attacker would then have to convince the victim to press Enter for the shell to process the title as a command, although the attacker could craft other escape sequences that might convince the victim to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0063 to this issue. - It is possible to lock up versions of Xterm by sending an invalid DEC UDK escape sequence. (CAN-2003-0071) - XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a vulnerability in the MIT-SHM extension of the X server that allows local users to read and write arbitrary shared memory. The original fix did not cover the case where the X server is started from xdm. - The X server was setting the /dev/dri directory permissions incorrectly, which resulted in the directory being world writable. It now sets the directory permissions to a safe value. (CAN-2001-1409) Driver updates and additions: - Savage driver updated to Tim Roberts' latest version 1.1.27t. - Added new "cyrix" driver from Alan Cox, which works much better on MediaGX hardware. - Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit), Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker (ur98) - Backported apm driver from XFree86 CVS, DPMS support enhancements, and a few accel fixes - Backported ark driver from XFree86 CVS - Backported chips driver from XFree86 CVS, with hardware mouse cursor and 2D accleration fixes. - Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS Various bug fixes and enhancements: - Bug fixes for the RENDER extension and libraries which improve stability - Various fixes to the Xaw library - A long standing problem in the X server has been fixed in which the mouse, keyboard, or video would hang, or the server to go into an endless loop whenever the system time was changed backward while X was running - Fixed a bug in both the Radeon and Rage 128 drivers which caused crashes while using VMware with DGA when DRI is enabled - The Matrox "mga" driver had some problems with multihead and the RENDER extension which have been worked around. - fc-cache is now run upon font package installation in all font directories containing fonts managed by fontconfig/Xft - mkfontdir has been modified to force the permissions of the files it generates to be mode 0644 ensuring they are world readable independant of umask. - Added a new option "ForceLegacyCRT" to the radeon driver to allow use of legacy VGA monitors which can not be detected automatically. This option is only safe to use in single-head setups and may cause serious problems if used with dual-head. - xterm session management is now enabled by default, whereas the stock XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream - Removed and obsoleted the XFree86-xtrap-clients package, and merged it into the main XFree86 package to simplify packaging There are various other fixes included which users can review by examining the RPM package changelog of any of the new XFree86 packages. Users are advised to upgrade to these updated XFree86 4.2.1 packages, which are not vulnerable to the previously mentioned security issues. Updated packages: Red Hat Linux 8.0 -------------------------------------------------------------------------------- SRPMS: XFree86-4.2.1-20.src.rpm [ via FTP ] [ via HTTP ] d8b6c711331c631c3d8aca71a596fa5f i386: XFree86-100dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 9159c60bdcdba1ae7e0c0599e0eaef5f XFree86-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 68ff4023c81b59621ccc2c1fcd6c50f3 XFree86-75dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 75ab424da96097c2e15437364efbd5d5 XFree86-base-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 501ab86d7597f9f2378dce40dd7146fd XFree86-cyrillic-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 38f584b4b9e6a6a501ae323bbf366c2c XFree86-devel-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] be757f89eb5ffe6903b35213b222e09c XFree86-doc-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] c32f8893dd354cdaca7e20be56bc5290 XFree86-font-utils-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 77ebf291729828fe129a2f394e00bf06 XFree86-ISO8859-15-100dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 34d8c4e9e02fc0b3bec18fe7080cfcb9 XFree86-ISO8859-15-75dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 0fb379911ca8f18c7c7ee79900d7ff0d XFree86-ISO8859-2-100dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 882bcdee8965ff1c48e27b7394dc2693 XFree86-ISO8859-2-75dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 3760aa56f6369543664842f0e4900a93 XFree86-ISO8859-9-100dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 75213bdae918d3419e6711a0afe485b1 XFree86-ISO8859-9-75dpi-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 0379dad294ff892af81445f80d8fd5d8 XFree86-libs-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 41f2f99950f65bfe0528e00a6c6aa1fa XFree86-Mesa-libGL-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] b55013e1ea311922ceeb729ee87616cb XFree86-Mesa-libGLU-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 4b2304052a6ef52e315e7d13044607df XFree86-tools-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] e8f4052121e7bd18494311614e14a759 XFree86-truetype-fonts-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 4b01bcb29d802e023ab703cd11a3cfb9 XFree86-twm-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 1cc9502e9a0e1526edd58e0aed2cd31c XFree86-xauth-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 6bedb659afe1d73e50dade694a0a8157 XFree86-xdm-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] e9a20db35fc1bb1053b664afa8fbc1ed XFree86-xfs-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 259c43f6d24e109154a989147571e7ce XFree86-Xnest-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] b6671415b3cfbdd9e6bf8b46e7375fcf XFree86-Xvfb-4.2.1-20.i386.rpm [ via FTP ] [ via HTTP ] 2dac01365800f3d00135dc1f357a43b3 Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. Bugs fixed: (see bugzilla for more information) 63509 - mouse event problems after system standby 69978 - Radeon failure with old VGA monitor 72297 - MediaGX 5530 XFree86 failure 73678 - Screen corruption when running full-screen VMware under DRI-enabled XFree86 75155 - lndir doesn't work with relative symlink 76154 - Mozilla with xft crashes on Red Hat 8.0 (Xrender bug) 77542 - XFree86-truetype-fonts does integrate with Xft/fontconfig 77930 - rhPrintOSKernelString can print stack garbage 78804 - Xutf8LookupString fails in UTF-8 locale if X server lacks XKB support 79488 - XKeysymDB is included in XFree86.rpm whereas it should be in XFree86-libs.rpm 83303 - Unresolved DRM symbols in r128 driver (4.2.1) 84036 - xauth can write incomplete .xauth files 88773 - xterm session management is disabled by default in XFree86 4.2.x References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0063 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0071 -------------------------------------------------------------------------------- The listed packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/solutions/security/news/publickey/#key You can verify each package and see who signed it with the following command: rpm --checksig -v filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum filename The Red Hat security contact is security@redhat.com. More contact details at http://www.redhat.com/solutions/security/news/contact.html [***** End Red Hat Security Advisory RHSA-2003:067-16 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat, Inc. for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) N-100: Microsoft Windows Media Services ISAPI Extenstion Flaw N-101: Microsoft Cumulative Patch for Internet Explorer (IE) N-102: Hewlett-Packard Potential Security Vulnerabilities in CDE N-103: Sun ONE Application Server May Disclose JavaServer Pages (JSP) Source N-104: Red Hat Updated KDE packages N-105: Sun "/usr/lib/utmp_update" Command Buffer Overflow Vulnerability N-106: SGI Websetup/Webmin Security Vulnerability N-107: PDF readers/viewers Malicious Hyperlinks Vulnerability N-108: Sun's XSun Program Buffer Overflow Vulnerability N-109: Microsoft Flaw in ISAPI Extension for Windows Media Services Could Cause Code Execution