Executive Summary

Summary
Title X.Org X server: Composite local privilege escalation
Informations
Name GLSA-200710-16 First vendor Publication 2007-10-14
Vendor Gentoo Last vendor Modification 2007-10-14
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score 4.3 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 3.1 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability has been discovered in the Composite extension of the X.Org X server, allowing for a local privilege escalation.

Background

The X Window System is a graphical windowing system based on a client/server model.

Description

Aaron Plattner discovered a buffer overflow in the compNewPixmap()
function when copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.

Impact

A local attacker could execute arbitrary code with the privileges of the user running the X server, typically root.

Workaround

Disable the Composite extension by setting ' Option "Composite"
"disable" ' in the Extensions section of xorg.conf.

Note: This could affect the functionality of some applications.

Resolution

All X.Org X server users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.3.0.0-r1"

References

[ 1 ] CVE-2007-4730 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4730

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200710-16.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200710-16.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10430
 
Oval ID: oval:org.mitre.oval:def:10430
Title: Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
Description: Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
Family: unix Class: vulnerability
Reference(s): CVE-2007-4730
 Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17717
 
Oval ID: oval:org.mitre.oval:def:17717
Title: USN-514-1 -- xorg-server vulnerability
Description: Aaron Plattner discovered that the Composite extension did not correctly calculate the size of buffers when copying between different bit depths.
Family: unix Class: patch
Reference(s): USN-514-1
CVE-2007-4730
 Version: 5
Platform(s): Ubuntu 6.06
 Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18611
 
Oval ID: oval:org.mitre.oval:def:18611
Title: DSA-1372-1 xorg-server - privilege escalation
Description: Aaron Plattner discovered a buffer overflow in the Composite extension of the X.org X server, which can lead to local privilege escalation.
Family: unix Class: patch
Reference(s): DSA-1372-1
CVE-2007-4730
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): xorg-server
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 5

OpenVAS Exploits

Date Description
2009-04-09 Name : Mandriva Update for x11-server MDKSA-2007:178 (x11-server)
File : nvt/gb_mandriva_MDKSA_2007_178.nasl
2009-03-23 Name : Ubuntu Update for xorg-server vulnerability USN-514-1
File : nvt/gb_ubuntu_USN_514_1.nasl
2009-01-28 Name : SuSE Update for XOrg SUSE-SA:2007:054
File : nvt/gb_suse_2007_054.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200710-16 (X.Org)
File : nvt/glsa_200710_16.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-07 (ltsp)
File : nvt/glsa_200805_07.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
37726 X.org X11 compalloc.c compNewPixmap Function Composite Pixmap Handling Local ...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0898.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20070919_xorg_x11_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2008-05-11 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200805-07.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xorg-x11-4485.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-514-1.nasl - Type : ACT_GATHER_INFO
2007-10-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200710-16.nasl - Type : ACT_GATHER_INFO
2007-09-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0898.nasl - Type : ACT_GATHER_INFO
2007-09-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0898.nasl - Type : ACT_GATHER_INFO
2007-09-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1372.nasl - Type : ACT_GATHER_INFO
2007-09-14 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-178.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:35:12
  • Multiple Updates