Date: Tue, 23 Jan 2001 13:02:27 -0800
From: FreeBSD Security Advisories <security-advisories@freebsd.org.>
To: [email protected]Subject: FreeBSD Ports Security Advisory: FreeBSD-SA-01:07.xfree86
-----BEGIN PGP SIGNED MESSAGE-----
FreeBSD-SA-01:07 Security Advisory
FreeBSD, Inc.
Topic: Multiple XFree86 3.3.6 vulnerabilities
Category: ports
Module: XFree86-3.3.6, XFree86-aoutlibs
Announced: 2001-01-23
Credits: Chris Evans <chris@ferret.lmh.ox.ac.uk.>
Michal Zalewski <lcamtuf@tpi.pl.>
Affects: Ports collection prior to the correction date.
Corrected: 2000-10-24 (XFree86-3.3.6)
Vendor status: Fixed in XFree86 4.0.1, no patches released by vendor.
FreeBSD only: NO
I. Background
XFree86 is a popular X server. It exists in three versions in the
FreeBSD ports collection: 3.3.6 and 4.0.2, as well as a.out libraries
based on XFree86 3.3.3.
II. Problem Description
The XFree86-3.3.6 port, versions prior to 3.3.6_1, has multiple
vulnerabilities that may allow local or remote users to cause a denial
of service attack against a vulnerable X server. Additionally, local
users may be able to obtain elevated privileges under certain
circumstances.
X server DoS:
Remote users can, by sending a malformed packet to port 6000 TCP,
cause the victim's X server to freeze for several minutes. During
the freeze, the mouse does not move and the screen does not update
in any way. In addition, the keyboard is unresponsive, including
console-switch and kill-server key combinations. Non-X processes,
such as remote command-line logins and non-X applications, are
unaffected by the freeze.
Xlib holes:
Due to various coding flaws in libX11, privileged (setuid/setgid)
programs linked against libX11 may allow local users to obtain
elevated privileges.
libICE DoS:
Due to inadequate bounds checking in libICE, a denial of service
exists with any application using libICE to listen on a network port
for network services.
The XFree86-aoutlibs port contains the XFree86 libraries from the
3.3.3 release of XFree86, in a.out format suitable for use with
applications in the legacy a.out binaryformat, most notably being the
FreeBSD native version of Netscape. It is unknown whether Netscape is
vulnerable to the problems described in this advisory, but it believed
that the only potential vulnerability is the libICE denial-of-service
condition described above.
The XFree86 and XFree86-aoutlibs ports are not installed by default
(although XFree86 is available as an installation option in the
FreeBSD installer), nor are they "part of FreeBSD" as such: they are
part of the FreeBSD ports collection, which contains almost 4500
third-party applications in a ready-to-install format. The ports
collections shipped with FreeBSD 3.5.1 and 4.1.1 contain these problem
since they were discovered after the releases, but the XFree86 problem
was corrected prior to the release of FreeBSD 4.2. At the time of
advisory release, the XFree86-aoutlibs port has not been corrected.
FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security
audit of the most security-critical ports.
III. Impact
Local or remote users may cause a denial of service attack against an
X server or certain X applications. Local users may obtain elevated
privileges with certain X applications.
If you have not chosen to install the XFree86 3.3.6 port/package or
the XFree86-aoutlibs port/package, or you are running XFree86 4.0.1 or
later, then your system is not vulnerable to this problem.
IV. Workaround
Deinstall the XFree86-3.3.6 and XFree86-aoutlibs ports/packages, if
you you have installed them.
Note that any statically linked binaries which make use of the
vulnerable XFree86 routines may still be vulnerable to the problems
after deinstallation of the port/package. However due to the
difficulty of developing a reliable scanning utility for such binaries
no such utility is provided.
V. Solution
One of the following:
1) Upgrade your entire ports collection and rebuild the XFree86-3.3.6
port.
2) Deinstall the old package and install an XFree86-4.0.2 package
obtained from:
[i386]
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/x11/XFree86-4.0.2_5.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/x11/XFree86-4.0.2_5.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/x11/XFree86-4.0.2_5.tgz
[alpha]
Packages are not automatically generated for the alpha architecture at
this time due to lack of build resources.
NOTE: XFree86-3.3.6 packages are no longer made available, only the
newer XFree86-4.0.2 packages.
Note also that the XFree86-aoutlibs port has not yet been fixed: there
is currently no solution to the problem other than removing the
port/package and recompiling any dependent software to use ELF
libraries, or switching to an ELF-based version of the software, if
available (e.g. the BSD/OS or Linux versions of Netscape, as an
alternative to the FreeBSD native version). The potential impact of
the vulnerabilities to the local environment may be deemed not
sufficiently great to warrant this approach, however.
3) download a new port skeleton for the XFree86-3.3.6 port from:
http://www.freebsd.org/ports/
and use it to rebuild the port.
4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBOm3xpFUuHi5z0oilAQF+zQQAiwIQSv6MemATgo6v2/QwMjttGpbMxbh2
s94CK+aAlbtRlsrBZl6DIWwVydc1C3k6EHnM+NHqwhfOq/yrwp7JDKwVUmvi+5Qx
1UAY8QRu45OednLsyT2qUuNrowjMmkdB0EcsqQq2UvLtN2054m6AmpZk1t3TjGTr
CCOFX30qIn0=
=pI+q
-----END PGP SIGNATURE-----
