Executive Summary

Summary
Title X.Org X Server: Privilege escalation
Informations
Name GLSA-201207-04 First vendor Publication 2012-07-09
Vendor Gentoo Last vendor Modification 2012-07-09
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A format string vulnerability in X.Org X Server may allow local privilege escalation or Denial of Service.

Background

The X Window System is a graphical windowing system based on a client/server model.

Description

The "LogVHdrMessageVerb()" function in log.c contains a format string vulnerability.

NOTE: Exposure to this vulnerability is reduced in Gentoo due to X.Org X Server being built with "-D_FORTIFY_SOURCE=2" by default.

Impact

A local attacker could gain escalated privileges or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All X.Org X Server 1.11.x users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.11.4-r1"

All X.Org X Server 1.10.x users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.10.6-r1"

X.Org X Server 1.9.x is not affected.

References

[ 1 ] CVE-2012-2118 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2118

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201207-04.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201207-04.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17036
 
Oval ID: oval:org.mitre.oval:def:17036
Title: USN-1502-1 -- xorg-server vulnerability
Description: The X.Org X server could be made to crash if a specially crafted input device was added.
Family: unix Class: patch
Reference(s): USN-1502-1
CVE-2012-2118
 Version: 5
Platform(s): Ubuntu 12.04
 Product(s): xorg-server
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2012-08-10 Name : Gentoo Security Advisory GLSA 201207-04 (xorg-server)
File : nvt/glsa_201207_04.nasl
2012-07-16 Name : Ubuntu Update for xorg-server USN-1502-1
File : nvt/gb_ubuntu_USN_1502_1.nasl

Nessus® Vulnerability Scanner

Date Description
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-139.nasl - Type : ACT_GATHER_INFO
2012-07-12 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1502-1.nasl - Type : ACT_GATHER_INFO
2012-07-10 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201207-04.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:37:29
  • Multiple Updates