5.1 - USN-182-1

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	X server vulnerability

Informations
Name	USN-182-1	First vendor Publication	2005-09-12
Vendor	Ubuntu	Last vendor Modification	2005-09-12
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Cvss Base Score	5.1	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	High
Cvss Expoit Score	4.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:

xserver-xfree86 xserver-xorg

The problem can be corrected by upgrading the affected package to version 4.3.0.dfsg.1-6ubuntu25.3 (for Ubuntu 4.10), or 6.8.2-10.1 (for Ubuntu 5.04). After a standard system upgrade you need to restart your X session to effect the necessary changes.

Details follow:

A local privilege escalation vulnerability has been discovered in the pixmap allocation handling of the X server. By allocating a huge pixmap, a local user could trigger an integer overflow that resulted in a memory allocation that was too small for the requested pixmap. This resulted in a buffer overflow which could eventually be exploited to execute arbitrary code with full root privileges.

Original Source

Url : http://www.ubuntu.com/usn/USN-182-1

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1044

Oval ID:	oval:org.mitre.oval:def:1044
Title:	Solaris Xsun Privilege Escalation via Pixmaps Vulnerability
Description:	Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2495	Version:	1
Platform(s):	Sun Solaris 8 Sun Solaris 9 Sun Solaris 10	Product(s):	X
Definition Synopsis:
Software section Solaris 8 (SPARC,Xsun) meets Sun Alert ID 101926 criteria. Solaris 8 Installed AND sparc architecture AND NOT Patch 108652-94 or later installed AND NOT File Xorg exists OR Solaris 9 (SPARC,Xsun) meets Sun Alert ID 101926 criteria. Solaris 9 Installed AND sparc architecture AND NOT Patch 112785-52 or later installed AND NOT File Xorg exists OR Solaris 10 (SPARC,Xsun) meets Sun Alert ID 101926 criteria. Solaris 10 Installed AND sparc architecture AND NOT Patch 119059-08 or later installed AND NOT File Xorg exists OR Solaris 8 (x86,Xsun) meets Sun Alert ID 101926 criteria. Solaris 8 Installed AND ix86 architecture AND NOT Patch 108653-83 or later installed AND NOT File Xorg exists OR Solaris 9 (x86,Xsun) meets Sun Alert ID 101926 criteria. Solaris 9 Installed AND ix86 architecture AND NOT Patch 112786-41 or later installed AND NOT File Xorg exists OR Solaris 10 (x86,Xsun) meets Sun Alert ID 101926 criteria. Solaris 10 Installed AND ix86 architecture AND NOT Patch 119060-08 or later installed AND NOT File Xorg exists AND Configuration section The Xsun X server is running

Definition Id: oval:org.mitre.oval:def:9615

Oval ID:	oval:org.mitre.oval:def:9615
Title:	Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
Description:	Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2495	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section XFree86-cyrillic-fonts is earlier than 0:4.3.0-95.EL AND XFree86-Xvfb is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-14-100dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-libs is earlier than 0:4.3.0-95.EL AND XFree86-75dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-truetype-fonts is earlier than 0:4.3.0-95.EL AND XFree86-twm is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-9-75dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-libs-data is earlier than 0:4.3.0-95.EL AND XFree86-doc is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-15-100dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-base-fonts is earlier than 0:4.3.0-95.EL AND XFree86-100dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-15-75dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-2-75dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-font-utils is earlier than 0:4.3.0-95.EL AND XFree86-Mesa-libGL is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-2-100dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-xdm is earlier than 0:4.3.0-95.EL AND XFree86-sdk is earlier than 0:4.3.0-95.EL AND XFree86 is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-9-100dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-Xnest is earlier than 0:4.3.0-95.EL AND XFree86-xfs is earlier than 0:4.3.0-95.EL AND XFree86-tools is earlier than 0:4.3.0-95.EL AND XFree86-syriac-fonts is earlier than 0:4.3.0-95.EL AND XFree86-ISO8859-14-75dpi-fonts is earlier than 0:4.3.0-95.EL AND XFree86-xauth is earlier than 0:4.3.0-95.EL AND XFree86-Mesa-libGLU is earlier than 0:4.3.0-95.EL AND XFree86-devel is earlier than 0:4.3.0-95.EL OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section xorg-x11-doc is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-libs is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-xauth is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-Mesa-libGLU is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-twm is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-Mesa-libGL is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-Xdmx is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-xfs is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-deprecated-libs-devel is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-devel is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-Xvfb is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-deprecated-libs is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-sdk is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-xdm is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-Xnest is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11 is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-font-utils is earlier than 0:6.8.2-1.EL.13.16 AND xorg-x11-tools is earlier than 0:6.8.2-1.EL.13.16

Definition Id: oval:org.mitre.oval:def:998

Oval ID:	oval:org.mitre.oval:def:998
Title:	Solaris Xorg Privilege Escalation via Pixmaps Vulnerability
Description:	Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2495	Version:	1
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):	X
Definition Synopsis:
Software section Solaris 9 (x86,Xorg) meets Sun Alert ID 101926 criteria. Solaris 9 Installed AND ix86 architecture AND NOT Patch 118908-02 or later installed AND File Xorg exists OR Solaris 10 (x86,Xorg) meets Sun Alert ID 101926 criteria. Solaris 10 Installed AND ix86 architecture AND NOT Patch 118966-09 or later installed AND File Xorg exists AND Configuration section The Xorg X server is running

CPE : Common Platform Enumeration

Type	Description	Count
Application	Xfree86 Project xfree86 cpe:2.3:a:xfree86_project:xfree86:4.2.1:::::::* cpe:2.3:a:xfree86_project:xfree86:4.2.0:::::::* cpe:2.3:a:xfree86_project:xfree86:4.1.0:::::::* cpe:2.3:a:xfree86_project:xfree86:4.0.3:::::::* cpe:2.3:a:xfree86_project:xfree86:4.0.2:::::::* cpe:2.3:a:xfree86_project:xfree86:4.0.1:::::::* cpe:2.3:a:xfree86_project:xfree86:4.0.0:::::::* cpe:2.3:a:xfree86_project:xfree86:3.3.6:::::::*	8

OpenVAS Exploits

Date	Description
2009-10-10	Name : SLES9: Security update for XFree86-Xvnc File : nvt/sles9p5009392.nasl
2009-10-10	Name : SLES9: Security update for XFree86-server File : nvt/sles9p5013484.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200509-07 (X.Org) File : nvt/glsa_200509_07.nasl
2008-09-04	Name : FreeBSD Ports: XFree86-Server File : nvt/freebsd_XFree86-Server0.nasl
0000-00-00	Name : Slackware Advisory SSA:2005-269-02 X.Org pixmap overflow File : nvt/esoft_slk_ssa_2005_269_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
19352	X11/XFree86 Pixmap Allocation Local Overflow

Nessus® Vulnerability Scanner

Date	Description
2015-04-02	Name : The remote host is missing Sun security patch number 119060-45. File : solaris10_x86_119060_45.nasl - Type : ACT_GATHER_INFO
2015-04-02	Name : The remote host is missing Sun security patch number 119059-46. File : solaris10_119059_46.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 118908-06 File : solaris9_x86_118908.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 119060-72 File : solaris10_x86_119060.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 119059-73 File : solaris10_119059.nasl - Type : ACT_GATHER_INFO
2006-08-08	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_32966.nasl - Type : ACT_GATHER_INFO
2006-08-08	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_32965.nasl - Type : ACT_GATHER_INFO
2006-08-08	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_32960.nasl - Type : ACT_GATHER_INFO
2006-07-05	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-396.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-501.nasl - Type : ACT_GATHER_INFO
2006-05-13	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_a863aa7424be11da8882000e0c33c2dc.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-182-1.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-269-02.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-164.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Debian host is missing a security-related update. File : debian_DSA-816.nasl - Type : ACT_GATHER_INFO
2005-09-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-501.nasl - Type : ACT_GATHER_INFO
2005-09-17	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-894.nasl - Type : ACT_GATHER_INFO
2005-09-17	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-893.nasl - Type : ACT_GATHER_INFO
2005-09-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-396.nasl - Type : ACT_GATHER_INFO
2005-09-13	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200509-07.nasl - Type : ACT_GATHER_INFO
2005-09-13	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-329.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 12:01:55	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	8
osvdb(s)	1
Openvas Exploit(s)	5
Nessus® Exploit(s)	21

	Related
5.1	CVE-2005-2495
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)