Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


More on LinuxToday


Red Hat Linux Advisory: XFree86

Jul 02, 2003, 03:52 (0 Talkback[s])

Red Hat Security Advisory

Synopsis: Updated XFree86 packages provide security and bug fixes
Advisory ID: RHSA-2003:067-02
Issue date: 2003-06-25
Updated on: 2003-07-01
Product: Red Hat Linux
Keywords:  
Cross references:  
Obsoletes: RHSA-2002:068
CVE Names: CAN-2001-1409 CAN-2002-1472 CAN-2002-0164 CAN-2003-0063 CAN-2003-0071

1. Topic:

New XFree86 packages for Red Hat Linux 8.0 are now available which include several security fixes, bug fixes, enhancements, and driver updates.

[Updated: June 30, 2003]
The XFree86 4.2.1-20 packages which were originally released in this advisory were accidentally built with debugging info enabled due to a temporary problem with our build system. Unfortunately, this problem was not noticed during package testing, and caused the new XFree86 packages to contain full debug symbol data, resulting in extremely large packages.

Note that the previously released packages are functional and should not cause any problems on systems with adequate disk space. However we are releasing new XFree86 4.2.1-21 packages to both minimize the download time for people that have not yet updated XFree86 on their systems, and to minimize the disk space footprint caused by this issue. Additionally, our testing procedures have also been updated to automatically catch similar issues in the future.

Red Hat apologizes for any inconvenience this may have caused you.

2. Relevant releases/architectures:

Red Hat Linux 8.0 - i386

3. Problem description:

XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers in Red Hat Linux.

A number of security vulnerabilities have been discovered in XFree86 4.2.0:

  • - Xterm, provided as part of the XFree86 packages, provides an escape sequence for reporting the current window title. This escape sequence essentially takes the current title and places it directly on the command line. An attacker can craft an escape sequence that sets the victim's Xterm window title to an arbitrary command, and then reports it to the command line. Since it is not possible to embed a carriage return into the window title, the attacker would then have to convince the victim to press Enter for the shell to process the title as a command, although the attacker could craft other escape sequences that might convince the victim to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2003-0063 to this issue.
  • - It is possible to lock up versions of Xterm by sending an invalid DEC UDK escape sequence. (CAN-2003-0071)
  • - XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a vulnerability in the MIT-SHM extension of the X server that allows local users to read and write arbitrary shared memory. The original fix did not cover the case where the X server is started from xdm.
  • - The X server was setting the /dev/dri directory permissions incorrectly, which resulted in the directory being world writable. It now sets the directory permissions to a safe value. (CAN-2001-1409)

Driver updates and additions:

  • - Savage driver updated to Tim Roberts' latest version 1.1.27t.
  • - Added new "cyrix" driver from Alan Cox, which works much better on MediaGX hardware.
  • - Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit), Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker (ur98)
  • - Backported apm driver from XFree86 CVS, DPMS support enhancements, and a few accel fixes
  • - Backported ark driver from XFree86 CVS
  • - Backported chips driver from XFree86 CVS, with hardware mouse cursor and 2D accleration fixes.
  • - Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS

Various bug fixes and enhancements:

  • - Bug fixes for the RENDER extension and libraries which improve stability
  • - Various fixes to the Xaw library
  • - A long standing problem in the X server has been fixed in which the mouse, keyboard, or video would hang, or the server to go into an endless loop whenever the system time was changed backward while X was running
  • - Fixed a bug in both the Radeon and Rage 128 drivers which caused crashes while using VMware with DGA when DRI is enabled
  • - The Matrox "mga" driver had some problems with multihead and the RENDER extension which have been worked around.
  • - fc-cache is now run upon font package installation in all font directories containing fonts managed by fontconfig/Xft
  • - mkfontdir has been modified to force the permissions of the files it generates to be mode 0644 ensuring they are world readable independant of umask.
  • - Added a new option "ForceLegacyCRT" to the radeon driver to allow use of legacy VGA monitors which can not be detected automatically. This option is only safe to use in single-head setups and may cause serious problems if used with dual-head.
  • - xterm session management is now enabled by default, whereas the stock XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
  • - Removed and obsoleted the XFree86-xtrap-clients package, and merged it into the main XFree86 package to simplify packaging

There are various other fixes included which users can review by examining the RPM package changelog of any of the new XFree86 packages.

Users are advised to upgrade to these updated XFree86 4.2.1 packages, which are not vulnerable to the previously mentioned security issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory only contains the desired RPMs.

Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

63509 - mouse event problems after system standby
69978 - Radeon failure with old VGA monitor
72297 - MediaGX 5530 XFree86 failure

73678 - Screen corruption when running full-screen VMware under DRI-enabled XFree86
75155 - lndir doesn't work with relative symlink
76154 - Mozilla with xft crashes on Red Hat 8.0 (Xrender bug)
77542 - XFree86-truetype-fonts does integrate with Xft/fontconfig
77930 - rhPrintOSKernelString can print stack garbage
78804 - Xutf8LookupString fails in UTF-8 locale if X server lacks XKB support
79488 - XKeysymDB is included in XFree86.rpm whereas it should be in XFree86-libs.rpm
83303 - Unresolved DRM symbols in r128 driver (4.2.1)
84036 - xauth can write incomplete .xauth files
88773 - xterm session management is disabled by default in XFree86 4.2.x

6. RPMs required:

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/XFree86-4.2.1-21.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-100dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-75dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGL-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGLU-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xnest-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xvfb-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-base-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-cyrillic-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-devel-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-doc-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-font-utils-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-libs-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-tools-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-truetype-fonts-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-twm-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xauth-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xdm-4.2.1-21.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xfs-4.2.1-21.i386.rpm

7. Verification:

MD5 sum Package Name


cee1de37fce0ec31cebae0f0e9a434a1 8.0/en/os/SRPMS/XFree86-4.2.1-21.src.rpm
7119350b159d4befa0d07021dec06294 8.0/en/os/i386/XFree86-100dpi-fonts-4.2.1-21.i386.rpm
c7b43b3a53dc0cdb84a7506db34609eb 8.0/en/os/i386/XFree86-4.2.1-21.i386.rpm
1ea257c46d0a8658f01670f4e4bbc4ec 8.0/en/os/i386/XFree86-75dpi-fonts-4.2.1-21.i386.rpm
881e3a0ebb397e8d0df456cc8c9c579f 8.0/en/os/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-21.i386.rpm
8dd41dba5fda9e99a9981a9cb643893c 8.0/en/os/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-21.i386.rpm
9d1224ed7e8d6a5145b72410f2caa507 8.0/en/os/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-21.i386.rpm
29cb82b5f73deddf2ffc770f7000548f 8.0/en/os/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-21.i386.rpm
9fa9a9be7c873a0d5950d028c6bc2acf 8.0/en/os/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-21.i386.rpm
ebfae00d164d0a56326236b8b12f96b2 8.0/en/os/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-21.i386.rpm
fc692fde2792c7b6742723b5ba66f56a 8.0/en/os/i386/XFree86-Mesa-libGL-4.2.1-21.i386.rpm
d4a9c9f9efa9a6cd004511811af76eb0 8.0/en/os/i386/XFree86-Mesa-libGLU-4.2.1-21.i386.rpm
4d82e2655550fa1e43a12d4636398016 8.0/en/os/i386/XFree86-Xnest-4.2.1-21.i386.rpm
676b0f5372b385e6bf7f361a2c2e91ec 8.0/en/os/i386/XFree86-Xvfb-4.2.1-21.i386.rpm
e2503059eebef52c1af80d2a060e6821 8.0/en/os/i386/XFree86-base-fonts-4.2.1-21.i386.rpm
85794c6ba7e916293a456ee26c5fcbe8 8.0/en/os/i386/XFree86-cyrillic-fonts-4.2.1-21.i386.rpm
7ab86737a76f07d8f1321b435f164546 8.0/en/os/i386/XFree86-devel-4.2.1-21.i386.rpm
36c11a280fc82e3620daaf6111c63a04 8.0/en/os/i386/XFree86-doc-4.2.1-21.i386.rpm
d2fbeb16e9827aea59cb93ed613c7be1 8.0/en/os/i386/XFree86-font-utils-4.2.1-21.i386.rpm
53df321f01b72e0b803e5f4249fc7897 8.0/en/os/i386/XFree86-libs-4.2.1-21.i386.rpm
23f949baa309259188b5763914540d8f 8.0/en/os/i386/XFree86-tools-4.2.1-21.i386.rpm
062dbae39362851adbc849803cc6a9ff 8.0/en/os/i386/XFree86-truetype-fonts-4.2.1-21.i386.rpm
39ecd87018be1baf6ad1ba79a7b2a150 8.0/en/os/i386/XFree86-twm-4.2.1-21.i386.rpm
a42683f46d9c1adb54db2fa6afe0fc46 8.0/en/os/i386/XFree86-xauth-4.2.1-21.i386.rpm
31e451f38efcd69cc0a5e67ce618fe89 8.0/en/os/i386/XFree86-xdm-4.2.1-21.i386.rpm
f4e47e7a0d3d9cb9146aae3354804692 8.0/en/os/i386/XFree86-xfs-4.2.1-21.i386.rpm

These packages are GPG signed by Red Hat for security. Our key is available from http://www.redhat.com/security/keys.html

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command:

md5sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1472
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0164
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0071

9. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact details at http://www.redhat.com/solutions/security/news/contact.html

Copyright 2003 Red Hat, Inc.