A buffer overflow vulnerability in libX11 may allow local unprivileged users to be able to execute arbitrary code or commands with elevated privileges. The code or commands executed would run with the privileges of the application dynamically linked to the libX11 library. A number of programs shipped in Solaris and by third parties dynamically link with the libX11 library and run with elevated privileges.

Sun acknowledges with thanks, RISE Security, for bringing this issue to our attention.

This issue is also referenced in: http://www.risesecurity.org/advisory/RISE-2006001.txt

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 119067-03
• Solaris 9 without patch 112785-56
• Solaris 10 without patch 119059-16

x86 Platform

• Solaris 8 without patch 119068-03
• Solaris 9 without patch 112786-45
• Solaris 10 without patch 119060-15

There are no predictable symptoms that would indicate the described vulnerability has been exploited to execute arbitrary code on a system.

To work around the described issue, remove setuid(2) and setgid(2) privileges from all programs that link with libX11.so.4.

Note: This may break the ability of these programs to perform their functions.

This solution has no attachment