Full Disclosure mailing list archives
Re: Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow
From: Roman Drahtmueller <draht () suse de>
Date: Fri, 13 Feb 2004 03:44:06 +0100 (MET)
i copy paste the wrong lines. if logged in on the console i get a segfault. using ssh i get: [evert@server evert]$ X :0 -fp $PWD Authentication failed - cannot start X server. Perhaps you do not have console ownership? [evert@server evert]$ so my real question was... is it still remotely (using a php include with apache or something) to exploit the bug?
For clarification: This is about fonts.dir and fonts.alias files that the X server reads if told so. The commandline is only an academic example. Place the two fonts.* files somewhere and use the "xset +fp somewhere" command to make the X server read them. For that, you need access to the Xserver using the configured access control mechanisms, usually xauth/cookies. The hurdle of the X Display access control makes the vulnerability a local vulnerability, regardless if the attack vector involves a network connection (X11 on port 6000 and maybe font-service on port 7100, also an option for placing fonts.*). An attack would target the privileges used by the X server: Usually root, by setuid-root or by xdm/kdm/gdm/wdm display managers/graphical logins.
kind regards, Evert
rgds, Roman. -- - - | Roman Drahtmüller <draht () suse de> // "You don't need eyes to see, | SUSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow Tim Yamin (Feb 11)
- Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow Evert Daman (Feb 12)
- Re: Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow qobaiashi (Feb 12)
- Re: Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow Evert Daman (Feb 12)
- Re: Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow Roman Drahtmueller (Feb 12)
- Re: Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow qobaiashi (Feb 12)
- Re: [ GLSA 200402-02 ] XFree86 Font Information File Buffer Overflow Evert Daman (Feb 12)