full-disclosure - Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0402130325220.25928@qrag.fhfr.qr>
From: draht at suse.de (Roman Drahtmueller)
Subject: Re: [ GLSA 200402-02 ] XFree86 Font Information
 File Buffer Overflow

> i copy paste the wrong lines. if logged in on the console
> i get a segfault. using ssh i get:
> 
> [evert@...ver evert]$ X :0 -fp $PWD
> Authentication failed - cannot start X server.
> Perhaps you do not have console ownership?
> [evert@...ver evert]$
> 
> so my real question was... is it still remotely (using a php
> include with apache or something) to exploit the bug?

For clarification: This is about fonts.dir and fonts.alias files that the
X server reads if told so. The commandline is only an academic example.  
Place the two fonts.* files somewhere and use the "xset +fp somewhere"
command to make the X server read them. 

For that, you need access to the Xserver using the configured access
control mechanisms, usually xauth/cookies. The hurdle of the X Display
access control makes the vulnerability a local vulnerability, regardless
if the attack vector involves a network connection (X11 on port 6000 and
maybe font-service on port 7100, also an option for placing fonts.*). An 
attack would target the privileges used by the X server: Usually root, by 
setuid-root or by xdm/kdm/gdm/wdm display managers/graphical logins.

> kind regards,
> Evert

rgds,
Roman.
-- 
 -                                                                      -
| Roman Drahtm?ller      <draht@...e.de> // "You don't need eyes to see, |
  SUSE Linux AG - Security       Phone: //             you need vision!"
| N?rnberg, Germany     +49-911-740530 //           Maxi Jazz, Faithless |
 -                                                                      -