Overview
A vulnerability in the X.Org X server could allow an attacker to execute arbitrary code with the privileges of the server.
Description
The X Window System provides a number of components to support graphical user interfaces, primarily on Unix-like operating systems. It features a client-server design whereby client applications specify instructions to a server (the X server) which then interacts with the display hardware to render graphics on the display. The X Rendering Extension (Render) introduces digital image composition as the foundation of a rendering model within the X Window System. The X.Org Foundation provides a free and open source implementation of the X Window System, including the X render extension. A flaw in the render extension, reportedly introduced through a typographical error, causes an incorrect computation for memory allocation size in XRenderCompositeTriStrip() and XRenderCompositeTriFan() requests. As a result, a buffer may be allocated that is too small to store the parameters of the request. For platforms where the ALLOCATE_LOCAL() macro is using alloca(), this situation can cause a stack overflow; on other platforms, it can cause a heap overflow. |
Impact
A client of the X server using the X render extension is able to send requests that will cause a buffer overflow in the server side of the extension. This overflow can be exploited by an authorized client to execute malicious code inside the X server, which is generally running with root privileges. |
Solution
Apply a patch |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://secunia.com/advisories/19900/
- http://secunia.com/advisories/19915/
- http://secunia.com/advisories/19916/
- http://secunia.com/advisories/19921/
- http://secunia.com/advisories/19943/
- http://secunia.com/advisories/19951/
- http://secunia.com/advisories/19956/
- http://secunia.com/advisories/19983/
- http://www.auscert.org.au/6259
- http://www.auscert.org.au/6268
- http://www.auscert.org.au/6271
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1
- http://www.ciac.org/ciac/bulletins/q-189.shtml
Acknowledgements
Thanks to the X.Org Foundation for reporting this vulnerability. They, in turn, credit Bart Massey with reporting this issue to them.
This document was written by Chad R Dougherty.
Other Information
| CVE IDs: | CVE-2006-1526 |
| Severity Metric: | 3.12 |
| Date Public: | 2006-05-02 |
| Date First Published: | 2006-06-16 |
| Date Last Updated: | 2006-07-05 19:51 UTC |
| Document Revision: | 34 |