|
Note: This is an archival copy of Security Sun Alert 200153 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000111.1. |
Category Security Release Phase Resolved Solaris 8 Operating System Solaris 9 Operating System Solaris 10 Operating System Bug Id 6635720, 6635721, 6635726, 6635727, 6635730, 6635732, 6635738, 6635740, 6636174 Date of Workaround Release 17-Jan-2008 Date of Resolved Release 01-FEB-2008 Multiple Security Vulnerabilities Exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC Extensions (see details below) 1. Impact Multiple security vulnerabilities exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC extensions to the Solaris X11 display server (Xorg(1), Xsun(1), and the Solaris X11 print server (Xprt(1)). These vulnerabilities may allow a local or remote unprivileged user who is authorized via xhost(1) or xauth(1) to connect to the X server and execute arbitrary code with root privileges, access arbitrary memory within the X server's address space, or crash the X11 display server process. The ability to crash the X11 display server is a type of Denial of Service (DoS). These issues are described in the following documents: CVE-2007-6427 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427 CVE-2007-6428 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428 CVE-2007-6429 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429 CVE-2007-5760 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760 2. Contributing Factors These issues can occur in the following releases: SPARC Platform
x86 Platform
Note: The Xorg(1) X server only ships on the x86 platform for Solaris 9 with the Sun Java Desktop System (JDS) release 2 installed, and on Solaris 10. To determine if JDS release 2 is installed on a Solaris 9 x86 system, the following command can be run: % grep distributor-version /usr/share/gnome-about/gnome-version.xml3. Symptoms If any of the described issues occur, the X server will exit and may generate an error message about a segmentation fault and may also write a core(4) file. 4. Workaround To work around the described issues for the Xorg(1) server, the affected X Server extensions may be disabled. The following command may be used to disable Xorg server extensions: $ /usr/X11/bin/Xorg -extension <Name of Extension> For example, the MIT-SHM extension may be disabled as follows: $ /usr/X11/bin/Xorg -extension MIT-SHM The X Server extensions may also be disabled by editing the xorg.conf(4) file. For example, to disable the MIT-SHM extension, the following lines may be added to the xorg.conf(4) file: Section "Extensions" Option "MIT-SHM" "disable" EndSection Notes: 1. After disabling X Server extensions, applications requiring those extensions may not run. 2. Only certain extensions can be disabled by the user. To list all extensions that can be disabled, run the following command: $ /usr/X11/bin/Xorg -extension help There is no workaround to the described issues for Xsun(1) server. The documented issues can be worked around by using the "noexec_user_stack" options to defeat the most common form of buffer overflow attacks that store executable exploit code on the stack. This can be achieved by editing the "/etc/system" file and adding the lines: set noexec_user_stack = 1 set noexec_user_stack_log = 1 A reboot will be necessary in order for the above change to take effect. See system(4) for information on modifying the system configuration information file. 5. ResolutionThis issue is addressed in the following releases: SPARC Platform
x86 Platform
For more information on Security Sun Alerts, see Sun 1009886.1. This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. Modification History 18-JAN-2008: Updated Contributing Factors, Relief/Workaround, Resolution sections 31-JAN-2008: Updated Contributing Factors, Resolution sections 01-FEB-2008: Updated Contributing Factors, Resolution sections, RESOLVED References119059-37118908-04 119060-36 125720-16 125719-07 119067-09 112785-63 119068-09 112786-52 Attachments This solution has no attachment | |||||||||||||||
|
|