X11R6 XKEYBOARD extension Strcmp() buffer overflow

Advisory Content :

RISE-2006001

X11R6 XKEYBOARD extension Strcmp() buffer overflow vulnerability

Released: September 07, 2006

Last updated: September 07, 2006

INTRODUCTION

There exists a vulnerability within a string manipulation function of the
X11R6

(X11R6.4 and lower) X Window System library, which when properly exploited
can

lead to local compromise of the vulnerable system.

This vulnerability was silently fixed in X11R6.5.1 release, but it is
still

present in multiple vendors operating systems source tree.

This vulnerability was confirmed by us in the following versions and
operating

systems, other versions and operating systems may be also affected.

Sun Solaris 10 SPARC/x86

Sun Solaris 9 SPARC/x86

Sun Solaris 8 SPARC/x86

SCO UnixWare 7.1.3

DETAILS

This vulnerability can be triggered by invoking a dynamicaly linked binary,
with

_XKB_CHARSET environment variable set to a long string value, and DISPLAY

environment variable set to a X Window System server with the XKEYBOARD

extension enabled.

This is the vulnerable function (from X11R6.4).

static int

#if NeedFunctionPrototypes

Strcmp(char *str1, char *str2)

#else

Strcmp(str1, str2)

char *str1, *str2;

#endif

{

char str[256];

char c, *s;

for (s = str; c = *str1++; ) {

if (isupper(c))

c = tolower(c);

*s++ = c;

}

*s = '

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

X11R6 XKEYBOARD extension Strcmp() buffer overflow