rhsa-2003:064
Vulnerability from csaf_redhat
Published
2003-06-25 15:51
Modified
2024-11-21 22:39
Summary
Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available

Notes

Topic
Updated XFree86 packages that resolve various security issues and additionally provide a number of bug fixes and enhancements are now available for Red Hat Linux 7.1 and 7.2.
Details
XFree86 is an implementation of the X Window System, which provides the graphical user interface, video drivers, etc. for Linux systems. Since the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of security vulnerabilities have been found and fixed. In addition, various other bug fixes, driver updates, and other enhancements have been made. Security fixes: Xterm, provided as part of the XFree86 packages, provides an escape sequence for reporting the current window title. This escape sequence essentially takes the current title and places it directly on the command line. An attacker can craft an escape sequence that sets the victim's Xterm window title to an arbitrary command, and then reports it to the command line. Since it is not possible to embed a carriage return into the window title, the attacker would then have to convince the victim to press Enter for the shell to process the title as a command, although the attacker could craft other escape sequences that might convince the victim to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0063 to this issue. It is possible to lock up versions of Xterm by sending an invalid DEC UDK escape sequence. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0071 to this issue. The xdm display manager, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1510 to this issue. These erratum packages also contain an updated fix for CAN-2002-0164, a vulnerability in the MIT-SHM extension of the X server that allows local users to read and write arbitrary shared memory. The original fix did not cover the case where the X server is started from xdm. The X server was setting the /dev/dri directory permissions incorrectly, which resulted in the directory being world writable. It now sets the directory permissions to a safe value. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to this issue. Driver updates and other fixes: The Rage 128 video driver (r128) has been updated to provide 2D support for all previously unsupported ATI Rage 128 hardware. DRI 3D support should also work on the majority of Rage 128 hardware. Bad page size assumptions in the ATI Radeon video driver (radeon) have been fixed to allow the driver to work properly on ia64 and other architectures where the page size is not fixed. A long-standing XFree86 bug has been fixed. This bug occurs when any form of system clock skew (such as NTP clock synchronization, APM suspend/resume cycling on laptops, daylight savings time changeover, or even manually setting the system clock forward or backward) could result in odd application behavior, mouse and keyboard lockups, or even an X server hang or crash. The S3 Savage driver (savage) has been updated to the upstream author's latest version "1.1.27t", which should fix numerous bugs reported by various users, as well as adding support for some newer savage hardware. Users are advised to upgrade to these updated packages, which are not vulnerable to the previously-mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated XFree86 packages that resolve various security issues and\nadditionally provide a number of bug fixes and enhancements are now\navailable for Red Hat Linux 7.1 and 7.2.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "XFree86 is an implementation of the X Window System, which provides the\ngraphical user interface, video drivers, etc. for Linux systems.\n\nSince the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of\nsecurity vulnerabilities have been found and fixed.  In addition, various\nother bug fixes, driver updates, and other enhancements have been made.\n\nSecurity fixes:\n\nXterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title.  This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline.   Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\nIt is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence.  The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.\n\nThe xdm display manager, with the authComplain variable set to false,\nallows arbitrary attackers to connect to the X server if the xdm auth\ndirectory does not exist.  The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.\n\nThese erratum packages also contain an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory.  The original fix did not\ncover the case where the X server is started from xdm.\n\nThe X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable.  It now sets the\ndirectory permissions to a safe value.  The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to\nthis issue.\n\nDriver updates and other fixes:\n\nThe Rage 128 video driver (r128) has been updated to provide 2D support\nfor all previously unsupported ATI Rage 128 hardware.  DRI 3D support\nshould also work on the majority of Rage 128 hardware.\n\nBad page size assumptions in the ATI Radeon video driver (radeon) have\nbeen fixed to allow the driver to work properly on ia64 and other\narchitectures where the page size is not fixed.\n\nA long-standing XFree86 bug has been fixed.  This bug occurs when any form\nof system clock skew (such as NTP clock synchronization, APM suspend/resume\ncycling on laptops, daylight savings time changeover, or even manually\nsetting the system clock forward or backward) could result in odd\napplication behavior, mouse and keyboard lockups, or even an X server hang\nor crash.\n\nThe S3 Savage driver (savage) has been updated to the upstream author\u0027s\nlatest version \"1.1.27t\", which should fix numerous bugs reported by\nvarious users, as well as adding support for some newer savage hardware.\n\nUsers are advised to upgrade to these updated packages, which are not\nvulnerable to the previously-mentioned security issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2003:064",
        "url": "https://access.redhat.com/errata/RHSA-2003:064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_064.json"
      }
    ],
    "title": "Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available",
    "tracking": {
      "current_release_date": "2024-11-21T22:39:55+00:00",
      "generator": {
        "date": "2024-11-21T22:39:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2003:064",
      "initial_release_date": "2003-06-25T15:51:00+00:00",
      "revision_history": [
        {
          "date": "2003-06-25T15:51:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2003-06-25T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:39:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.1",
                "product": {
                  "name": "Red Hat Linux 7.1",
                  "product_id": "Red Hat Linux 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.2",
                "product": {
                  "name": "Red Hat Linux 7.2",
                  "product_id": "Red Hat Linux 7.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2001-1409",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616706"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-1409"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616706",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
        }
      ],
      "release_date": "2001-08-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:51:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:064"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0164",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0164"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
        }
      ],
      "release_date": "2002-05-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:51:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:064"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1510",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616920"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1510"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616920",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616920"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1510",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1510"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510"
        }
      ],
      "release_date": "2001-12-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:51:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:064"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2003-0063",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616948"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2003-0063"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616948",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
          "url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
        }
      ],
      "release_date": "2003-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:51:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:064"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2003-0071",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2003-0071"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
          "url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
        }
      ],
      "release_date": "2003-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:51:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:064"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.