Note: This is an archival copy of Security Sun Alert 200153 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000111.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
6635720, 6635721, 6635726, 6635727, 6635730, 6635732, 6635738, 6635740, 6636174
Date of Workaround Release
Date of Resolved Release
Multiple Security Vulnerabilities Exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC Extensions (see details below)
Multiple security vulnerabilities exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC extensions to the Solaris X11 display server (Xorg(1), Xsun(1), and the Solaris X11 print server (Xprt(1)). These vulnerabilities may allow a local or remote unprivileged user who is authorized via xhost(1) or xauth(1) to connect to the X server and execute arbitrary code with root privileges, access arbitrary memory within the X server's address space, or crash the X11 display server process. The ability to crash the X11 display server is a type of Denial of Service (DoS).
These issues are described in the following documents:
CVE-2007-6427 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
CVE-2007-6428 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
CVE-2007-6429 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
CVE-2007-5760 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760
2. Contributing Factors
These issues can occur in the following releases:
Note: The Xorg(1) X server only ships on the x86 platform for Solaris 9 with the Sun Java Desktop System (JDS) release 2 installed, and on Solaris 10.
To determine if JDS release 2 is installed on a Solaris 9 x86 system, the following command can be run:
% grep distributor-version /usr/share/gnome-about/gnome-version.xml3. Symptoms
If any of the described issues occur, the X server will exit and may generate an error message about a segmentation fault and may also write a core(4) file.
To work around the described issues for the Xorg(1) server, the affected X Server extensions may be disabled.
The following command may be used to disable Xorg server extensions:
$ /usr/X11/bin/Xorg -extension <Name of Extension>
For example, the MIT-SHM extension may be disabled as follows:
$ /usr/X11/bin/Xorg -extension MIT-SHM
The X Server extensions may also be disabled by editing the xorg.conf(4) file. For example, to disable the MIT-SHM extension, the following lines may be added to the xorg.conf(4) file:
Section "Extensions" Option "MIT-SHM" "disable" EndSection
1. After disabling X Server extensions, applications requiring those extensions may not run.
2. Only certain extensions can be disabled by the user. To list all extensions that can be disabled, run the following command:
$ /usr/X11/bin/Xorg -extension help
There is no workaround to the described issues for Xsun(1) server.
The documented issues can be worked around by using the "noexec_user_stack" options to defeat the most common form of buffer overflow attacks that store executable exploit code on the stack. This can be achieved by editing the "/etc/system" file and adding the lines:
set noexec_user_stack = 1 set noexec_user_stack_log = 1
A reboot will be necessary in order for the above change to take effect. See system(4) for information on modifying the system configuration information file.5. Resolution
This issue is addressed in the following releases:
For more information on Security Sun Alerts, see Sun 1009886.1.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
18-JAN-2008: Updated Contributing Factors, Relief/Workaround, Resolution sections
31-JAN-2008: Updated Contributing Factors, Resolution sections
01-FEB-2008: Updated Contributing Factors, Resolution sections, RESOLVED
This solution has no attachment