[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

XF86 server denial of service

At least woody seems to be affected. Please double check this.


XFree86 Xserver Denial of Service Vulnerability

_/info\_ _/discussion\_ _/exploit\_ _/solution\_ _/credit\_ _/help\_

A denial of service exists in XFree86 3.3.5, 3.3.6 and 4.0. A remote user can send a malformed packet to the TCP listening port, 6000, which will cause the X server to be unresponsive for some period of time. During this time, the keyboard will not respond to user input, and in some cases, the mouse will also not respond. During this time period, the X server will utilize 100% of the CPU, and can only be repaired by being signaled. This vulnerability exists only in servers compiled with the XCSECURITY #define set. This can be verified by running the following:
strings /path/to/XF86_SVGA | grep "XC-QUERY-SECURITY-1"

To quote the Bugtraq post, by Chris Evans <chris@ferret.lmh.ox.ac.uk>:
"Observe xc/programs/Xserver/os/secauth.c, AuthCheckSitePolicy():

// dataP is user supplied data from the network
char *policy = *dataP;
int nPolicies;
// Oh dear, we can set nPolicies to -1
nPolicies = *policy++;
while (nPolicies) {
// Do some stuff in a loop

So, the counter "nPolicies", if seeded with -1, will decrement towards
about minus 2 billion, then wrap to become positive 2 billion, and head
towards its final destination of 0."

< http://www.securityfocus.com/bid/1235 >

Privacy Statement
Copyright © 1999-2000 SecurityFocus.com

Reply to: