Note: This is an archival copy of Security Sun Alert 201791 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1001329.1.
Article ID : 1001329.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2006-05-22
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the Xorg(1) Version of the Render Extension



Category
Security

Release Phase
Resolved

Product
Solaris 10 Operating System

Bug Id
6416841

Date of Workaround Release
04-MAY-2006

Date of Resolved Release
17-MAY-2006

Impact

The Xorg X server (see Xorg(1)) is one of the X Window System display servers available on the Solaris x86 platform. A buffer overflow in the X Render extension may allow an unprivileged local or remote user who is a client of the Xorg X server the ability to execute arbitrary code with the privileges of the Xorg server. The Xorg X server runs with root privileges on Solaris.

This issue is described in the following documents:


Contributing Factors

This issue can occur in the following release:

x86 Platform

  • Solaris 10 without patch 118966-20

Note: Solaris 8 and Solaris 9 are not affected by this issue. Solaris 10 on the SPARC platform is also not affected.

The described issue only occurs on systems with the SUNWxorg packages installed. To determine if the SUNWxorg packages are installed on the system, the following command can be used:

    pkginfo SUNWxorg-server

 


Symptoms

There are no predictable symptoms that would show the described issue has been exploited.


Workaround

To work around the described issue, disable the Render extension by putting the following in the xorg.conf(4) file:

    Section "Extensions"
Option "RENDER" "disable"
    EndSection

Note: After applying this workaround, applications requiring the Render extension may not run.


Resolution

This issue is addressed in the following release:

x86 Platform

  • Solaris 10 with patch 118966-20 or later


Modification History
Date: 17-MAY-2006
  • State: Resolved
  • Updated Contributing Factors, Relief/Workaround, and Resolution sections


References

118966-20




Attachments
This solution has no attachment