---------- Forwarded message ---------- Date: Sun, 10 May 1998 22:29:01 +1000 From: matthew green <mrgat_private> To: current-usersat_private, netbsd-announceat_private Cc: tech-securityat_private Subject: NetBSD Security Advisory 1998-002 -----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 1998-002 --------------------------------- Topic: xterm and Xaw library vulnerability Version: NetBSD 1.3, 1.3.1 Severity: local user may gain super-user privileges Abstract - -------- Vulnerabilities (buffer overflows) in the xterm(1) and Xaw library distributed with NetBSD, may allow a local user to gain super-user privileges. The `inputMethod' and `preeditType' resources are vulnerable in both xterm(1) and the Xaw library, with the `*Keymap' resources also vulnerable in xterm(1). Technical Details - ----------------- Several memory copies in the xterm(1) and Xaw library do not properly bounds check their arguments, allowing the user to overwrite parts of the processes address space. By overwriting the programs' stack, it is possible to change the return value of the current function to the data written, arbitrary code can be executed, allowing a local user to gain super-user privileges, as xterm(1) is setuid-root. Any setuid program that uses the Xaw library is similarly affected. In NetBSD, the only setuid-root X11 programs are xterm(1) and xconsole(1). Solutions and Workarounds - ------------------------- A patch is available for the NetBSD 1.3 and NetBSD 1.3.1 X11 source, which fixes the above problems. You may find this patch on the NetBSD ftp server: ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19980503-xsrc The patch contains details on how to apply it. Alternatively, by removing the setuid bit on the xterm(1) and xconsole(1) programs, the problem can be worked out (but with a loss of functionality). This can be done with the following command: # chmod u-s /usr/X11R6/bin/xconsole /usr/X11R6/bin/xterm Thanks To - --------- Thanks to the The Open Group and CERT for forwarding information about the problems, Tom E. Dickey <dickeyat_private> and the XFree86 team for providing actual fixes for the xterm and Xaw problems, respectively. Please see http://www.opengroup.org/, http://www.cert.org/ and http://www.XFree86.org/ for more information about these groups. More Information - ---------------- Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 1998, The NetBSD Foundation. All Rights Reserved. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBNVWbfz5Ru2/4N2IFAQGyzQQAsX5sSw2KYD4gwY5bIz8JUfH1bc7gC65V o65GJ1psgdPElA0HsbSeDOi1bA0BlWVmB3BC0w9Im9gcN+Upj2su56BteyT9kHwe XVDSFZ+wk6SgQkDhpbZGIL5eDauLJRLc5FLh7p/Myh5Ye/6CTNWI3evtxE1VOtum mhK3O0fR0zs= =f0Sv -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:53:04 PDT