Executive Summary
| Summary | |
|---|---|
| Title | Updated XFree86 packages fix security issues and bugs |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2004:478 | First vendor Publication | 2004-10-04 |
| Vendor | RedHat | Last vendor Modification | 2004-10-04 |
| Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated XFree86 packages that fix several security flaws in libXpm, as well as other bugs, are now available for Red Hat Enterprise Linux 3. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon. During a source code audit, Chris Evans discovered several stack overflow flaws and an integer overflow flaw in the X.Org libXpm library used to decode XPM (X PixMap) images. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0687, CAN-2004-0688, and CAN-2004-0692 to these issues. A flaw was found in the X Display Manager (XDM). XDM is shipped with Red Hat Enterprise Linux, but is not used by default. XDM opened a chooserFd TCP socket even if the DisplayManager.requestPort parameter was set to 0. This allowed authorized users to access a machine remotely via X, even if the administrator had configured XDM to refuse such connections. Although XFree86 4.3.0 was not vulnerable to this issue, Red Hat Enterprise Linux 3 contained a backported patch which introduced this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0419 to this issue. Users are advised to upgrade to these erratum packages, which contain backported security patches to correct these and a number of other issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info): 124901 - CAN-2004-0419 xdm opens random tcp sockets 126205 - xdm walks physical memory 129744 - Radeon driver (7000m) TVDAC output too high for DELL Server 131121 - CAN-2004-0687/8 libXpm stack and integer overflows. 132121 - archexec script not in XFree86-devel package |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2004-478.html |
OVAL Definitions
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for openmotif File : nvt/sles9p5020391.nasl |
| 2009-10-10 | Name : SLES9: Security update for qt3 File : nvt/sles9p5018833.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenMotif File : nvt/sles9p5014940.nasl |
| 2009-10-10 | Name : SLES9: Security update for openmotif File : nvt/sles9p5010938.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200407-05 (xdm) File : nvt/glsa_200407_05.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-07 (openmotif) File : nvt/glsa_200502_07.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200410-09 (lesstif) File : nvt/glsa_200410_09.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200409-34 (X) File : nvt/glsa_200409_34.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200408-20 (Qt) File : nvt/glsa_200408_20.nasl |
| 2008-09-04 | Name : FreeBSD Ports: xorg-clients File : nvt/freebsd_xorg-clients.nasl |
| 2008-09-04 | Name : FreeBSD Ports: qt File : nvt/freebsd_qt.nasl |
| 2008-09-04 | Name : FreeBSD Ports: linux_base File : nvt/freebsd_linux_base.nasl |
| 2008-09-04 | Name : FreeBSD Ports: linux-gdk-pixbuf File : nvt/freebsd_linux-gdk-pixbuf.nasl |
| 2008-09-04 | Name : xpm -- image decoding vulnerabilities File : nvt/freebsd_agenda-snow-libs.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 542-1 (qt-copy) File : nvt/deb_542_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 561-1 (xfree86) File : nvt/deb_561_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 560-1 (lesstif1-1) File : nvt/deb_560_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2004-236-01 Qt File : nvt/esoft_slk_ssa_2004_236_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 10034 | libXpm ParseAndPutPixels Function Stack Overflow A local overflow exists in libXpm. The ParseAndPutPixels function fails to validate user-supplied input resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
| 10033 | libXpm ParsePixels Function Integer Overflow A local overflow exists in libXpm. The ParsePixels function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
| 10032 | libXpm CreateXImage Function Integer Overflow A local overflow exists in libXpm. The CreateXImage function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
| 10031 | libXpm XpmCreateImageFromXpmImage Function Integer Overflow A local overflow exists in libXpm. The XpmCreateImageFromXpmImage function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
| 10030 | libXpm xpmParseColors Function Integer Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
| 10029 | libXpm xpmParseColors Function XPMv2/3 Parsing Stack Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied XPMv2/3 image files resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
| 10028 | libXpm xpmParseColors Function XPMv1 Parsing Stack Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied XPMv1 image files resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
| 10027 | libXpm ParsePixels Function Stack Overflow A local overflow exists in libXpm. The ParsePixels function fails to validate user-supplied input resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
| 10026 | libXpm ParseAndPutPixels Function Integer Overflow A local overflow exists in libXpm. The ParseAndPutPixels function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
| 9036 | Qt XPM Parser NULL Dereference Remote DoS Qt contains a flaw that may allow a remote denial of service. The issue is triggered when a NULL derefernce occurs in the XPM parser, and will result in loss of availability for the system running Qt. No further details have been provided. |
| 6502 | OpenBSD XFree86 xdm Random TCP Port Listening XFree86 - used in some versions of OpenBSD - contains a flaw where XFree86 listens for queries on a random TCP port, even when the service is disabled. It is possible that the flaw may allow unintended remote access resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-01-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0524.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_9399.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_ff00f2cec54c11d8b70800061bc2ad93.nasl - Type : ACT_GATHER_INFO |
| 2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33132.nasl - Type : ACT_GATHER_INFO |
| 2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33130.nasl - Type : ACT_GATHER_INFO |
| 2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33129.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-27-1.nasl - Type : ACT_GATHER_INFO |
| 2005-09-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-815.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ef253f8b072711d9b45d000c41e2cdad.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-236-01.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_bf2e7483d3fa440d8c6e8f1f2f018818.nasl - Type : ACT_GATHER_INFO |
| 2005-05-03 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2005-005.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-07.nasl - Type : ACT_GATHER_INFO |
| 2005-01-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-004.nasl - Type : ACT_GATHER_INFO |
| 2004-12-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-537.nasl - Type : ACT_GATHER_INFO |
| 2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-560.nasl - Type : ACT_GATHER_INFO |
| 2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-561.nasl - Type : ACT_GATHER_INFO |
| 2004-11-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-124.nasl - Type : ACT_GATHER_INFO |
| 2004-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200410-09.nasl - Type : ACT_GATHER_INFO |
| 2004-10-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-479.nasl - Type : ACT_GATHER_INFO |
| 2004-10-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-478.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-542.nasl - Type : ACT_GATHER_INFO |
| 2004-09-27 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200409-34.nasl - Type : ACT_GATHER_INFO |
| 2004-09-17 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_034.nasl - Type : ACT_GATHER_INFO |
| 2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-098.nasl - Type : ACT_GATHER_INFO |
| 2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-099.nasl - Type : ACT_GATHER_INFO |
| 2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200408-20.nasl - Type : ACT_GATHER_INFO |
| 2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200407-05.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_qt_333.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-270.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-271.nasl - Type : ACT_GATHER_INFO |
| 2004-08-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-414.nasl - Type : ACT_GATHER_INFO |
| 2004-08-22 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-085.nasl - Type : ACT_GATHER_INFO |
| 2004-08-20 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_027.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-073.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:48:41 |
|
| 2013-05-11 12:22:38 |
|
