-----BEGIN PGP SIGNED MESSAGE-----
Buffer overflow in the resource handling code of the libXt (X11R6)
Thu May 29, 1997
Distribution of this document is unlimited
Copyright (C) Alexander O. Yuriev (alex@yuriev.com)
Net Access
Abstract
A buffer overflow was found in the resource handling section of the X11
system (libXt). As this is a problem with libXt iself, every program
using libXt is affected, including core programs such as xterm and
programs derived from it. Of course only suid and sgid programs can be
exploited to gain access to gain extra priviledges.
Permanent Solution
The permanent solution requires fixing the libXt. It is recommended
that you utilize temporary solution. This buffer overflow does not
exist in XFree86 3.3 code. It is recommended that you upgrade to
XFree86 3.3 as soon as it becomes available.
Currently fixed versions of fixed libraries are available for:
o Red Hat Linux 4.0, 4.1, 4.2 from Red Hat Software
Temporary solution
The workaround requires identifying and temporary disabling suid
programs in the X11R6 tree. The following sequence of commands can be
used to find all suid and sgid programs of the X11 tree:
$ cd /usr/X11/bin
$ find . -type f -a \( -perm -2000 -o -perm -4000 \) -print
As the output, these commands would produce a list of suid or sgid
programs in directories starting from the current working directory
(/usr/X11/bin) to the end of the tree. A typical output would look
like:
X
xterm
dga
Determine if you use every program in question. Look at the manual
pages to see if you really need it at this time. I personally have no
idea why Red Hat did not remove the dga(1) program of the XFree86
distribution shipped with Red Hat 4.1 as dga(1) manual page states:
dga - test program for the Xfree86-DGA extension
Assuming that the DGA extension is required, the test program should be
used only by "root". Therefore, the suid bit is not needed and
should
be removed. Same logic should be applied to other suid/sgid programs.
At this time you probably should remove suid bit from the dga(1) or at
least make it non-world executable. Use commands:
# chmod 111 dga
# chattr +I dga
to disable suid bit on a dga binary and make it immutable. Use the same
method to evaluate all other suid programs.
Programs that should be run by root only, should never be suid to root,
or at least should not be world executable. X Display Manager, xdm(1),
falls into this category.
If you need the functionality provided by the vulnerable program,
disable execution for that program and add trusted accounts that need
to run the program into the group which own the program. You must
realize that by doing this you are allowing those who have access to
the trusted accounts exploit the vulnerability and gain access to the
euid of the program.
XTERM(1) and xterm derived programs
Unfortunately, you cannot remove suid bit from the xterm(1) and
programs derived from it withot losing part of functionality. The
advice by authors of exploits from bugtraq to squash suid bit prevents
xterm(1) from changing ownerships of tty devices allowing any user on a
system to read information from terminal devices.
This looks like a lose-lose situation unless you are willing to disable
xterm(1) program completely (and leave with it being disabled ) until
the fixed version becomes available. Basically, you should consider
risks of someone from your system running xterm(1) and gaining root
access to a system vs. not being able to run xterm(1) at all and vs.
running xterm(1) as non-suid application which would allow one user to
intercept keystrokes of another. It is your choice but no matter what
you decide to do, think about the consequences first.
Vendor fixes
* Red Hat Linux from Red Hat Software
o Red Hat Linux/Alpha 4.1, 4.2
ftp://ftp.redhat.com/updates/4.2/alpha/XFree86-devel-3.2-10.alpha.rpm
ftp://ftp.redhat.com/updates/4.2/alpha/XFree86-libs-3.2-10.alpha.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-devel-3.2-10.alpha.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-libs-3.2-10.alpha.rpm
o Red Hat Linux/Intel 4.0, 4.1, 4.2
ftp://ftp.redhat.com/updates/4.2/i386/XFree86-devel-3.2-10.i386.rpm
ftp://ftp.redhat.com/updates/4.2/i386/XFree86-libs-3.2-10.i386.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-devel-3.2-10.i386.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-libs-3.2-10.i386.rpm
o Red Hat Linux/SPARC 4.0, 4.1, 4.2
ftp://ftp.redhat.com/updates/4.2/sparc/X11R6.1-devel-pl1-21.sparc.rpm
ftp://ftp.redhat.com/updates/4.2/sparc/X11R6.1-libs-pl1-21.sparc.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/X11R6.1-devel-pl1-21.sparc.rpm
ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/X11R6.1-libs-pl1-21.sparc.rpm
Please verify the signature of RPMs using the rpm --checksig
command. The RPMs are signed with the PGP key of Red Hat Software:
pub 1024/CBA29BF9 1996/02/20 Red Hat Software, Inc.
<redhat@redhat.com>
Acknowledgements
The exploits were posted in bugtraq mailing list by Ming Zhang. Erik
Troan (ewt@redhat.com) from Red Hat Software provided information about
the XFree86 3.3, as well as fixes for the Red Hat Linux
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBM43KJIxFUz2t8+6VAQEH4wP6A7R1AZUnpOkiHlyzX/EObvLtnU9oWza9
kYWgpCGQJGfgoHpw33J5DGG9bg+iev35EViSt+z4GZveaJyioqtY31OETw9uRaO1
BgsoNqLSG8EhgucVTxBe72iSa3CvI3Mc9QHRgNMkiogxEkiR7QYaiiRyOmrjKfe5
dvbtOjCiyIM=ItFv
-----END PGP SIGNATURE-----
Marcin Bohosiewicz
1997-May-29 17:14 UTC
Re: Vulnerability of suid/sgid programs using libXt
On Thu, 29 May 1997, Alexander O. Yuriev wrote:> o Red Hat Linux/Intel 4.0, 4.1, 4.2 > > > ftp://ftp.redhat.com/updates/4.2/i386/XFree86-devel-3.2-10.i386.rpm > ftp://ftp.redhat.com/updates/4.2/i386/XFree86-libs-3.2-10.i386.rpm > ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-devel-3.2-10.i386.rpm > ftp://ftp.aoy.com/pub/Linux/security/DISTRIBUTION-FIXES/RedHat/XFree86-libs-3.2-10.i386.rpmI mirrored this patch from ftp.aoy.com in Poland. It''s available from: ftp://venus.wis.pk.edu.pl/pub/RPMS/XFree86-devel-3.2-10.i386.rpm ftp://venus.wis.pk.edu.pl/pub/RPMS/XFree86-libs-3.2-10.i386.rpm M. -| == Marcin Bohosiewicz marcus@venus.wis.pk.edu.pl == |- -| == tel. +048 (0-12) 37-44-99 marcus@krakow.linux.org.pl == |- -| == Strona Domowa - http://venus.wis.pk.edu.pl/marcus/ == |-