Multiple Security Vulnerabilities Exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC Extensions (see details below)

Multiple security vulnerabilities exist in the X11 XInput, EVI, MIT SHM and XFree86-MISC extensions to the Solaris X11 display server (Xorg(1), Xsun(1), and the Solaris X11 print server (Xprt(1)). These vulnerabilities may allow a local or remote unprivileged user who is authorized via xhost(1) or xauth(1) to connect to the X server and execute arbitrary code with root privileges, access arbitrary memory within the X server's address space, or crash the X11 display server process. The ability to crash the X11 display server is a type of Denial of Service (DoS).

These issues are described in the following documents:

CVE-2007-6427 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427

CVE-2007-6428 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428

CVE-2007-6429 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429

CVE-2007-5760 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 119067-09
• Solaris 9 without patch 112785-63 (for Xsun(1))
• Solaris 10 without patch 119059-37 (for Xsun(1))
• Solaris 10 without patch 125719-07 (for Xorg(1))
  

x86 Platform

• Solaris 8 without patch 119068-09
• Solaris 9 without patch 112786-52 (for Xsun(1))
• Solaris 9 without patch 118908-04 (for Xorg(1))
• Solaris 10 without patch 119060-36 (for Xsun(1))
• Solaris 10 without patch 125720-16 (for Xorg(1))

Note: The Xorg(1) X server only ships on the x86 platform for Solaris 9 with the Sun Java Desktop System (JDS) release 2 installed, and on Solaris 10.

To determine if JDS release 2 is installed on a Solaris 9 x86 system, the following command can be run:

    % grep distributor-version /usr/share/gnome-about/gnome-version.xml 
    <distributor-version>Sun Java Desktop System, Release 2</distributor-version>

If any of the described issues occur, the X server will exit and may generate an error message about a segmentation fault and may also write a core(4) file.

To work around the described issues for the Xorg(1) server, the affected X Server extensions may be disabled.

The following command may be used to disable Xorg server extensions:

    $ /usr/X11/bin/Xorg -extension <Name of Extension>

For example, the MIT-SHM extension may be disabled as follows:

    $ /usr/X11/bin/Xorg -extension MIT-SHM

The X Server extensions may also be disabled by editing the xorg.conf(4) file. For example, to disable the MIT-SHM extension, the following lines may be added to the xorg.conf(4) file:

    Section "Extensions"
    Option "MIT-SHM" "disable"
    EndSection

Notes:

1. After disabling X Server extensions, applications requiring those extensions may not run.

2. Only certain extensions can be disabled by the user. To list all extensions that can be disabled, run the following command:

    $ /usr/X11/bin/Xorg -extension help

There is no workaround to the described issues for Xsun(1) server.

The documented issues can be worked around by using the "noexec_user_stack" options to defeat the most common form of buffer overflow attacks that store executable exploit code on the stack. This can be achieved by editing the "/etc/system" file and adding the lines:

    set noexec_user_stack = 1
    set noexec_user_stack_log = 1

A reboot will be necessary in order for the above change to take effect. See system(4) for information on modifying the system configuration information file.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 119067-09 or later (for Xsun(1))
• Solaris 9 with patch 112785-63 or later (for Xsun(1))
• Solaris 10 with patch 119059-37 or later (for Xsun(1))
• Solaris 10 with patch 125719-07 or later (for Xorg(1))
  

x86 Platform

• Solaris 8 with patch 119068-09 or later (for Xsun(1))
• Solaris 9 with patch 112786-52 or later (for Xsun(1))
• Solaris 9 with patch 118908-04 or later (for Xorg(1))
• Solaris 10 with patch 119060-36 or later (for Xsun(1))
• Solaris 10 with patch 125720-16 or later (for Xorg(1))

For more information on Security Sun Alerts, see Sun Infodoc 91209.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

18-JAN-2008: Updated Contributing Factors, Relief/Workaround, Resolution sections
31-JAN-2008: Updated Contributing Factors, Resolution sections
01-FEB-2008: Updated Contributing Factors, Resolution sections, RESOLVED

This solution has no attachment