Multiple security vulnerabilities exist in the X11 FreeType library and  X11 display servers Xsun(1) and Xorg(1).

The XC-MISC extension is used by the X11 display servers to manage resource IDs. A local or remote unprivileged user who is able to display data on a running X11 server instance may be able to elevate their privileges to root and execute arbitrary code or cause a Denial of Service (DOS) to that X11 server instance resulting from memory corruption in ProxXCMiscGetXIDList.

This issue is described in the following documents:

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=503

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003

http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html

The X11 display servers contain a flaw that may allow a local or remote unprivileged user who is able to display data on a running X11 server instance to elevate their privileges to root and execute arbitrary code or cause a Denial of Service (DOS) to that X11 server instance when a BDF font file specifies that there are more then 2^30 characters defined in the font file.

This issue is described in the following documents:

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=501

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351

http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html

The X11 Free Type library and X11 display servers contain a flaw that may allow a local or remote unprivileged user who is able to display data on a running X11 server instance to elevate their privileges to root and execute arbitrary code or cause a Denial of Service (DOS) to that X11 server instance by causing the server to load a long path name in the fonts.dir file for a font.

This issue is described in the following documents:

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=502

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352

http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 119067-07 (for Xsun(1))
• Solaris 8 without patch 124420-02 (for libfreetype)
• Solaris 9 without patch 112785-61 (for Xsun(1))
• Solaris 9 without patch 116105-07 (for libfreetype)
• Solaris 10 without patch 119059-25 (for Xsun(1))
• Solaris 10 without patch 119812-03 (for libfreetype)

x86 Platform

• Solaris 8 without patch 119068-07 (for Xsun(1))
• Solaris 8 without patch 124421-02 (for libfreetype)
• Solaris 9 without patch 112786-50 (for Xsun(1))
• Solaris 9 without patch 124833-02 (for Xorg(1))
• Solaris 9 without patch 116106-06 (for libfreetype)
• Solaris 10 without patch 119060-24 (for Xsun(1))
• Solaris 10 without patch 125720-03 (for Xorg(1))
• Solaris 10 without patch 119813-04 (for libfreetype)

Note: The Xorg(1) X server only ships on the x86 platform for Solaris 9 with the Sun Java Desktop System (JDS) release 2 installed, and on Solaris 10.

To determine if JDS release 2 is installed on a Solaris 9 x86 system, the following command can be run:

% grep distributor-version /usr/share/gnome-about/gnome-version.xml
<distributor-version>Sun Java Desktop System, Release 2</distributor-version>

There are no predictable symptoms that would indicate the described issues have been exploited.

To prevent this issue from being exploited to execute arbitrary commands with elevated privileges, the setuid(2) bit can be removed from the Xorg server and the Xsun server on the x86 platform and the setgid(2) bit can be removed from the Xsun server on the SPARC platform. For example:

  # chmod 0755 /usr/openwin/bin/Xsun
  # chmod 0755 /usr/X11/bin/Xorg

Similar chmod commands will need to be used on a setuid(2) or setgid(2) application that links to the Free Type library (libfreetype). To determine if a setuid(2) or setgid(2) application links to the Free Type library do the following:

  # ldd /usr/bin/fc-cache | grep freetype
  libfreetype.so.6 =>   /usr/sfw/lib/libfreetype.so.6

If the fc-cache application had been setuid(2) or setgid(2) then performing the chmod commands would be appropriate.

Note 1: Performing the above procedure will disable the following:

• The ability to start either the Xsun(1) or Xorg(1) server from the command line for non-root users on the Solaris x86 platform.
• The ability of Xsun(1) and Xorg(1) to open Unix domain sockets and named pipe transports in the protected "/tmp/.X11-*" directories.
• The ability to configure Power Management and Interactive Process Priority control on Solaris SPARC.

These features will still be available to Xsun and Xorg when started via a display manager such as dtlogin(1), gdm(1), or xdm(1).

Note 2: There is no workaround to prevent this issue from being exploited to cause a Denial Of Service to the X Servers.

Note 3: The "chmod" command for Xorg(1) is applicable only to Solaris 9 and 10.

Note 4: Local users on the console of a system using an X display manager and Sun Ray users may still be able to exploit this vulnerability to execute arbitrary commands with elevated privileges even if the setuid and setgid permissions have been removed from the Xsun and Xorg binaries.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 119067-07 or later (for Xsun(1)
• Solaris 8 with patch 124420-02 or later (for libfreetype)
• Solaris 9 with patch 112785-61 or later (for Xsun(1))
• Solaris 9 with patch 116105-07 or later (for libfreetype)
• Solaris 10 with patch 119059-25 or later (for Xsun(1))
• Solaris 10 with patch 119812-03 or later (for libfreetype)

x86 Platform

• Solaris 8 with patch 119068-07 or later (for Xsun(1))
• Solaris 8 with patch 124421-02 or later (for libfreetype)
• Solaris 9 with patch 112786-50 or later (for Xsun(1))
• Solaris 9 with patch 124833-02 or later (for Xorg(1))
• Solaris 9 with patch 116106-06 or later (for libfreetype)
• Solaris 10 with patch 119060-24 or later (for Xsun(1))
• Solaris 10 with patch 125720-03 or later (for Xorg(1))
• Solaris 10 with patch 119813-04 or later (for libfreetype)

• Updated Contributing Factors and Resolution sections

• State: Resolved
• Updated Contributing Factors and Resolution sections

• Now Resolved
• Updated Contributing Factors and Resolution sections

This solution has no attachment