bugtraq - Xpra memory disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4F173552.6060002@nagafix.co.uk>
Date: Thu, 19 Jan 2012 04:10:42 +0700
From: Antoine Martin <antoine@...afix.co.uk>
To: bugtraq@...urityfocus.com
Subject: Xpra memory disclosure

Xpra is screen for X11. This is the fork located at:
http://xpra.org/

Xpra versions 0.0.7.28 (r191) through to 0.0.7.34 (r443) return random
chunks of memory to the clients by using the wrong size (multiplying by
4) for the X11 cursor memory buffer. (from XFixesGetCursorImage)
The byte order of the data returned is only slightly off (argb -> rgba)

Clients can easily trigger this bug by using X11 applications with
custom cursors, potentially many times per second. However the risks
should be fairly limited since Xpra and its Xvfb process typically run
with the same uid as the client application they host.

Thanks to 'fecund' for reporting this.
Only OpenBSD terminated the process, other unices are quite happy to let
you access memory beyond the end of the cursor buffer.

Cheers
Antoine