Vous êtes ici: index » cert » avis

Avis du CERT RENATER

Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés

Date : Thu, 02 Oct 2008 11:08:26 +0200
Type : VULN
Sujet : CERT-Renater : 2008/VULN402 (Sun: Multiple Security Vulnerabilities in the Solaris X Server Extensions)
====================================================================                                   CERT-Renater

                        Note d'Information No. 2008/VULN402
_____________________________________________________________________

DATE                      : 02/10/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Solaris 8, Solaris 9, Solaris 10 running
                             Solaris X Server Extensions.

======================================================================
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-238686-1
______________________________________________________________________

Solution Type: Sun Alert
   Solution  238686 :   Multiple Security Vulnerabilities in the Solaris
   X Server Extensions may lead to a Denial of Service (DoS) condition
   or allow Execution of Arbitrary Code
   Bug ID: 6683567, 6683568

   Product
   Solaris 8 Operating System, Solaris 9 Operating System, Solaris 10
   Operating System, OpenSolaris

   Date of Workaround Release: 12-Jun-2008

   Date of Resolved Release: 30-Sep-2008

   SA Document Body
   Multiple Security Vulnerabilities in the Solaris X Server Extensions
   may lead to a Denial of Service (DoS) condition or allow Execution of
   Arbitrary Code

   1. Impact
   Multiple integer, heap and buffer overflow security vulnerabilities
   exist in the Render, RECORD, Security, and MIT-SHM Extensions to the
   Solaris X11 display server (Xorg(1) and Xsun(1)) and the Solaris X11
   print server (Xprt(1)).  These vulnerabilities may allow a local or
   remote unprivileged user who is authorized (via xhost(1) or xauth(1))
   to connect to the X server and execute arbitrary code with root
   privileges, access arbitrary memory within the X server's address
   space, or crash the X11 display server process. The ability to crash
   the X11 display server is a type of Denial of Service (DoS).
   These issues are described in the following documents:

   CVE-2008-2360 at
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360
   CVE-2008-2361 at
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361
   CVE-2008-2362 at
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362
   CVE-2008-1379 at
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379
   CVE-2008-1377 at
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377

   2. Contributing Factors
   These issues can occur in the following releases:
   SPARC Platform
     * Solaris 8 without patch 119067-10 (for Xsun(1))
     * Solaris 9 without patch 112785-64 (for Xsun(1))
     * Solaris 10 without patches 119059-44 and 125719-12
     * OpenSolaris based upon builds snv_01 or later

   x86 Platform
     * Solaris 8 without patch 119068-10 (for Xsun(1))
     * Solaris 9 without patch 112786-53 (for Xsun(1))
     * Solaris 9 without patch 118908-06 (for Xorg)
     * Solaris 10 without patches 119060-43 and 125720-23
     * OpenSolaris based upon builds snv_01 or later

   Notes:
   1. To determine if JDS release 2 is installed on a Solaris 9 x86
      system, the following command can be run:

      % grep distributor-version /usr/share/gnome-about/gnome-version.xml
      Sun Java Desktop System, Release
2

   2. Only OpenSolaris installations including the affected binary
      "/usr/X11/bin/i386/Xorg" are impacted by this issue.

   3. OpenSolaris distributions may include additional bug fixes above
      and beyond the base build from which it was derived.  The base
      build can be derived as follows:

      $ uname -a
      SunOS osolsys 5.11 snv_86 i86pc i386 i86pc

   4. To determine if the affected X Server extensions are enabled on a
      running X server, the following command can be run:

      $ xdpyinfo | egrep "MIT-SHM|RENDER|SECURITY|RECORD"
      MIT-SHM
      RECORD
      RENDER
      SECURITY

   On Solaris 10, in the case of Xsun(1), the issues reported in
   CVE-2008-2360, CVE-2008-2361 and CVE-2008-2362 will not be applicable
   by default. They will be applicable only if the user has turned on
   the RENDER extension support by adding "+xrender" CLI option to Xsun,
   in which case the user can work around it by removing the "+xrender"
   option.  Also, these issues are not applicable for Xsun(1) server on
   Solaris 8 as the RENDER extension support is not present.

   3. Symptoms
   There are no predictable symptoms that would indicate these issues
   have been exploited to execute arbitrary code.
   If any of the described issues do occur, the X server will exit and
   may generate an error message about a segmentation fault and may also
   write a core(4) file.

   4. Workaround
   To work around the described issues for the Xorg(1) server, the
   affected X Server extensions may be disabled.
   The following command may be used to disable Xorg server extensions:

      $ /usr/X11/bin/Xorg -extension 

   This change will be valid until the Xorg server is restarted, for
   example on logout. The command will need to be repeated for each new
   instance of the Xorg server.
   For example, the MIT-SHM extension may be disabled as follows:

      $ /usr/X11/bin/Xorg -extension MIT-SHM

   The X Server extensions may also be disabled by editing the
   xorg.conf(4) file. For example, to disable the MIT-SHM extension, the
   following lines may be added to the xorg.conf(4) file:

   Section "Extensions"
       Option "MIT-SHM" "disable"
       Option "RENDER" "disable"
       Option "SECURITY" "disable"
   EndSection
   Section "Module"
       Disable "record"
   EndSection

   Notes:
   1. After disabling X Server extensions, applications requiring those
      extensions may not run.

   2. Only certain extensions can be disabled by the user. To list all
      extensions that can be disabled, the following command can be run:

      $ /usr/X11/bin/Xorg -extension help

   For Xsun(1) server, there is no workaround to the issues described in
   CVE-2008-1377 and CVE-2008-1379.
   To work around the issues for Xsun(1) server with Render support
   enabled on Solaris 10 (reported in CVE-2008-2360, CVE-2008-2361 and
   CVE-2008-2362) remove the "+xrender" option to Xsun.

   On Solaris 9, there is no workaround for the issues reported in
   CVE-2008-2360, CVE-2008-2361 and CVE-2008-2362 for Xsun(1) server.
   The documented issues can be worked around by using the
   "noexec_user_stack" options to defeat the most common form of buffer
   overflow attacks that store executable exploit code on the stack. This
   can be achieved by editing the "/etc/system" file and adding the
   lines:

   set noexec_user_stack = 1
   set noexec_user_stack_log = 1

   A reboot will be necessary in order for the above change to take
   effect. See system(4) for information on modifying the system
   configuration information file.

   5. Resolution
   This issue is addressed in the following releases:
   SPARC Platform
     * Solaris 8 with patch 119067-10 or later (for Xsun(1))
     * Solaris 9 with patch 112785-64 or later (for Xsun(1))
     * Solaris 10 with patches 119059-44 or later and 125719-12
       or later

   x86 Platform
     * Solaris 8 with patch 119068-10 or later (for Xsun(1))
     * Solaris 9 with patch 112786-53 or later (for Xsun(1))
     * Solaris 9 with patch 118908-06 or later (for Xorg)
     * Solaris 10 with patches 119060-43 or later and 125720-23
       or later

   For more information on Security Sun Alerts, see Technical
   Instruction ID 213557.

   This Sun Alert notification is being provided to you on an "AS IS"
   basis. This Sun Alert notification may contain information provided by
   third parties. The issues described in this Sun Alert notification may
   or may not impact your system(s). Sun makes no representations,
   warranties, or guarantees as to the information contained herein. ANY
   AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
   NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
   YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
   INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
   OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
   This Sun Alert notification contains Sun proprietary and confidential
   information. It is being provided to you pursuant to the provisions of
   your agreement to purchase services from Sun, or, if you do not have
   such an agreement, the Sun.com Terms of Use. This Sun Alert
   notification may only be used for the purposes contemplated by these
   agreements.
   Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa
   Clara, CA 95054 U.S.A. All rights reserved

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================