search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

X11 vulnerable to buffer overflow in handling of -xrm option

Vulnerability Note VU#169059

Original Release Date: 2002-09-16 | Last Revised: 2003-03-24

Overview

The X11 library included with many UNIX variants contains a buffer-overflow vulnerability that may allow attackers to gain root privileges.

Description

The X11 library contains an unspecified buffer-overflow vulnerability. Programs that use this library and accept the -xrm option (including xterm) also contain this vulnerability.

Impact

Attackers may be able to gain root privileges by exploiting affected setuid root programs (such as xterm) that use the X11 library.

Solution

Apply a patch

See the Systems Affected section for details, or contact your vendor directly.

None.

Vendor Information

169059
 
Expand all

The SCO Group (SCO UnixWare) Affected

Notified:  January 28, 2002 Updated: September 13, 2002

Status

Affected

Vendor Statement

Any command linked to this library that accepts the -xrm option [including xterm] will core dump if a long string is used as the argument. Any setuid setgid program that accepts the -xrm option is vulnerable to attack.

We now have fixes for this issue for both Open UNIX and UnixWare on our security website:

http://stage.caldera.com/support/security/

as advisory CSSA-2002-SCO.15.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Apple Computer Inc. Not Affected

Notified:  September 12, 2002 Updated: September 16, 2002

Status

Not Affected

Vendor Statement

Regarding VU#169059 - X11 vulnerable to buffer overflow, we do not ship the X11 libraries in Mac OS X or Mac OS X Server.

This means that Mac OS X and Mac OS X Server are not vulnerable to this problem unless a user adds the X11 libraries on their own.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company Not Affected

Notified:  September 12, 2002 Updated: March 24, 2003

Status

Not Affected

Vendor Statement

Source:
Hewlett-Packard Company
Software Security Response Team

cross reference id: SSRT2275

  HP-UX         - not vulnerable

  HP-MPE/ix     - not vulnerable

  HP Tru64 UNIX - not vulnerable

  HP OpenVMS    - not vulnerable

  HP NonStop Servers - not vulnerable

To report potential security vulnerabilities in HP software,
send an E-mail message to: mailto:security-alert@hp.com

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

MontaVista Software Not Affected

Notified:  September 12, 2002 Updated: September 16, 2002

Status

Not Affected

Vendor Statement

None of our products are vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Openwall GNU/*/Linux Not Affected

Notified:  September 12, 2002 Updated: September 16, 2002

Status

Not Affected

Vendor Statement

We don't re-distribute X11.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to jG gM for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

CVE IDs: CVE-2002-0517
Severity Metric: 6.78
Date Public: 1997-05-28
Date First Published: 2002-09-16
Date Last Updated: 2003-03-24 20:53 UTC
Document Revision: 15

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis