Red Hat Linux Advisories: ypserv, XFree86

Red Hat Security Advisory

Synopsis:	Updated ypserv packages fix a denial of service vulnerability
Advisory ID:	RHSA-2003:173-01
Issue date:	2003-06-25
Updated on:	2003-06-25
Product:	Red Hat Linux
Keywords:	NIS ypserver DOS
Cross references:
Obsoletes:
CVE Names:	CAN-2003-0251

1. Topic:

Updated ypserv packages fixing a denial of service vulnerability
are now available.

2. Relevant releases/architectures:

Red Hat Linux 7.1 – i386
Red Hat Linux 7.2 – i386, ia64
Red Hat Linux 7.3 – i386
Red Hat Linux 8.0 – i386
Red Hat Linux 9 – i386

3. Problem description:

The ypserv package contains the Network Information Service
(NIS) server.

A vulnerability has been discovered in the ypserv NIS server
prior to version 2.7. If a malicious client queries ypserv via TCP
and subsequently ignores the server’s response, ypserv will block
attempting to send the reply. This results in ypserv failing to
respond to other client requests.

Versions 2.7 and above of ypserv have been altered to fork a
child for each client request, thus preventing any one request from
causing the server to block.

Red Hat recommends that users of NIS upgrade to these packages,
which contain version 2.8.0 of ypserv and are therefore not
vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.

Please note that this update is also available via Red Hat
Network. Many people find this an easier way to apply updates. To
use Red Hat Network, launch the Red Hat Update Agent with the
following command:

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. RPMs required:

Red Hat Linux 7.1:

SRPMS:

ftp://updates.redhat.com/7.1/en/os/SRPMS/ypserv-2.8-0.72E.src.rpm

i386:

ftp://updates.redhat.com/7.1/en/os/i386/ypserv-2.8-0.72E.i386.rpm

Red Hat Linux 7.2:

SRPMS:

ftp://updates.redhat.com/7.2/en/os/SRPMS/ypserv-2.8-0.72E.src.rpm

i386:

ftp://updates.redhat.com/7.2/en/os/i386/ypserv-2.8-0.72E.i386.rpm

ia64:

ftp://updates.redhat.com/7.2/en/os/ia64/ypserv-2.8-0.72E.ia64.rpm

Red Hat Linux 7.3:

SRPMS:

ftp://updates.redhat.com/7.3/en/os/SRPMS/ypserv-2.8-0.73E.src.rpm

i386:

ftp://updates.redhat.com/7.3/en/os/i386/ypserv-2.8-0.73E.i386.rpm

Red Hat Linux 8.0:

SRPMS:

ftp://updates.redhat.com/8.0/en/os/SRPMS/ypserv-2.8-0.80E.src.rpm

i386:

ftp://updates.redhat.com/8.0/en/os/i386/ypserv-2.8-0.80E.i386.rpm

Red Hat Linux 9:

SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/ypserv-2.8-0.9E.src.rpm

i386:
ftp://updates.redhat.com/9/en/os/i386/ypserv-2.8-0.9E.i386.rpm

6. Verification:

MD5 sum Package Name

db17bee9fdb6d553dbb57850abff456a
7.1/en/os/SRPMS/ypserv-2.8-0.72E.src.rpm
a51f5a9adf6ff4f255678e7407982a7e
7.1/en/os/i386/ypserv-2.8-0.72E.i386.rpm
db17bee9fdb6d553dbb57850abff456a
7.2/en/os/SRPMS/ypserv-2.8-0.72E.src.rpm
a51f5a9adf6ff4f255678e7407982a7e
7.2/en/os/i386/ypserv-2.8-0.72E.i386.rpm
c300d319d7e883d5197b63f2e23fec88
7.2/en/os/ia64/ypserv-2.8-0.72E.ia64.rpm
c1977878cc0c0f90a9d55a4ae3b3bfe3
7.3/en/os/SRPMS/ypserv-2.8-0.73E.src.rpm
4af8d607cf8ba600288b5a5f164bf2f6
7.3/en/os/i386/ypserv-2.8-0.73E.i386.rpm
a606ee4aedc08cf7065e39d79b5e7474
8.0/en/os/SRPMS/ypserv-2.8-0.80E.src.rpm
9b72853f34de52966ff929218d1948bf
8.0/en/os/i386/ypserv-2.8-0.80E.i386.rpm
158b6b1ea17e996f2909ed98e444d683
9/en/os/SRPMS/ypserv-2.8-0.9E.src.rpm
86be6a349c1770893c6965611e29dc70
9/en/os/i386/ypserv-2.8-0.9E.i386.rpm

These packages are GPG signed by Red Hat for security. Our key
is available from http://www.redhat.com/security/keys.html

You can verify each package with the following command:

rpm –checksig -v <filename>

If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:

md5sum <filename>

7. References:

http://www.linux-nis.org/nis/ypserv/ChangeLog

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0251

8. Contact:

The Red Hat security contact is <[email protected]>. More
contact details at http://www.redhat.com/solutions/security/news/contact.html

Red Hat Security Advisory

Synopsis:	Updated XFree86 packages provide security and bug fixes
Advisory ID:	RHSA-2003:067-01
Issue date:	2003-06-25
Updated on:	2003-06-25
Product:	Red Hat Linux
Keywords:
Cross references:
Obsoletes:	RHSA-2002:068
CVE Names:	CAN-2001-1409 CAN-2002-1472 CAN-2002-0164 CAN-2003-0063 CAN-2003-0071

1. Topic:

Updated XFree86 packages for Red Hat Linux 8.0 are now available
which include several security fixes, bug fixes, enhancements, and
driver updates.

2. Relevant releases/architectures:

Red Hat Linux 8.0 – i386

3. Problem description:

XFree86 is an implementation of the X Window System providing
the core graphical user interface and video drivers in Red Hat
Linux.

A number of security vulnerabilities have been discovered in
XFree86 4.2.0:

Xterm, provided as part of the XFree86 packages, provides an
escape sequence for reporting the current window title. This escape
sequence essentially takes the current title and places it directly
on the command line. An attacker can craft an escape sequence that
sets the victim’s Xterm window title to an arbitrary command, and
then reports it to the command line. Since it is not possible to
embed a carriage return into the window title, the attacker would
then have to convince the victim to press Enter for the shell to
process the title as a command, although the attacker could craft
other escape sequences that might convince the victim to do so. The
Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0063 to this issue.
It is possible to lock up versions of Xterm by sending an
invalid DEC UDK escape sequence. (CAN-2003-0071)
XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows
local users to read and write arbitrary shared memory. The original
fix did not cover the case where the X server is started from
xdm.
The X server was setting the /dev/dri directory permissions
incorrectly, which resulted in the directory being world writable.
It now sets the directory permissions to a safe value.
(CAN-2001-1409)

Driver updates and additions:

Savage driver updated to Tim Roberts’ latest version
1.1.27t.
Added new “cyrix” driver from Alan Cox, which works much better
on MediaGX hardware.
Added new input drivers from Alan Cox for Fujitsu Stylistic
(fpit), Palmax PD1000/PD1100 Input driver (palmax), Union Reality
UR-98 head tracker (ur98)
Backported apm driver from XFree86 CVS, DPMS support
enhancements, and a few accel fixes
Backported ark driver from XFree86 CVS
Backported chips driver from XFree86 CVS, with hardware mouse
cursor and 2D accleration fixes.
Backported cirrus i740, siliconmotion, and ark drivers from
XFree86 CVS

Various bug fixes and enhancements:

Bug fixes for the RENDER extension and libraries which improve
stability
Various fixes to the Xaw library
A long standing problem in the X server has been fixed in which
the mouse, keyboard, or video would hang, or the server to go into
an endless loop whenever the system time was changed backward while
X was running
Fixed a bug in both the Radeon and Rage 128 drivers which
caused crashes while using VMware with DGA when DRI is enabled
The Matrox “mga” driver had some problems with multihead and
the RENDER extension which have been worked around.
fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
mkfontdir has been modified to force the permissions of the
files it generates to be mode 0644 ensuring they are world readable
independant of umask.
Added a new option “ForceLegacyCRT” to the radeon driver to
allow use of legacy VGA monitors which can not be detected
automatically. This option is only safe to use in single-head
setups and may cause serious problems if used with dual-head.
xterm session management is now enabled by default, whereas the
stock XFree86 default in 4.2.0/4.2.1 was accidentally disabled
upstream
Removed and obsoleted the XFree86-xtrap-clients package, and
merged it into the main XFree86 package to simplify packaging

There are various other fixes included which users can review by
examining the RPM package changelog of any of the new XFree86
packages.

Users are advised to upgrade to these updated XFree86 4.2.1
packages, which are not vulnerable to the previously mentioned
security issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):

63509 – mouse event problems after system standby
69978 – Radeon failure with old VGA monitor
72297 – MediaGX 5530 XFree86 failure
73678 – Screen corruption when running full-screen VMware under
DRI-enabled XFree86
75155 – lndir doesn’t work with relative symlink
76154 – Mozilla with xft crashes on Red Hat 8.0 (Xrender bug)
77542 – XFree86-truetype-fonts does integrate with
Xft/fontconfig
77930 – rhPrintOSKernelString can print stack garbage
78804 – Xutf8LookupString fails in UTF-8 locale if X server lacks
XKB support
79488 – XKeysymDB is included in XFree86.rpm whereas it should be
in XFree86-libs.rpm
83303 – Unresolved DRM symbols in r128 driver (4.2.1)
84036 – xauth can write incomplete .xauth files
88773 – xterm session management is disabled by default in XFree86
4.2.x

6. RPMs required:

Red Hat Linux 8.0:

SRPMS:

ftp://updates.redhat.com/8.0/en/os/SRPMS/XFree86-4.2.1-20.src.rpm

i386:

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-100dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-75dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGL-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Mesa-libGLU-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xnest-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-Xvfb-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-base-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-cyrillic-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-devel-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-doc-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-font-utils-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-libs-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-tools-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-truetype-fonts-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-twm-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xauth-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xdm-4.2.1-20.i386.rpm

ftp://updates.redhat.com/8.0/en/os/i386/XFree86-xfs-4.2.1-20.i386.rpm

7. Verification:

MD5 sum Package Name

d8b6c711331c631c3d8aca71a596fa5f
8.0/en/os/SRPMS/XFree86-4.2.1-20.src.rpm
9159c60bdcdba1ae7e0c0599e0eaef5f
8.0/en/os/i386/XFree86-100dpi-fonts-4.2.1-20.i386.rpm
68ff4023c81b59621ccc2c1fcd6c50f3
8.0/en/os/i386/XFree86-4.2.1-20.i386.rpm
75ab424da96097c2e15437364efbd5d5
8.0/en/os/i386/XFree86-75dpi-fonts-4.2.1-20.i386.rpm
34d8c4e9e02fc0b3bec18fe7080cfcb9
8.0/en/os/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-20.i386.rpm

0fb379911ca8f18c7c7ee79900d7ff0d
8.0/en/os/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-20.i386.rpm
882bcdee8965ff1c48e27b7394dc2693
8.0/en/os/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-20.i386.rpm
3760aa56f6369543664842f0e4900a93
8.0/en/os/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-20.i386.rpm
75213bdae918d3419e6711a0afe485b1
8.0/en/os/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-20.i386.rpm
0379dad294ff892af81445f80d8fd5d8
8.0/en/os/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-20.i386.rpm
b55013e1ea311922ceeb729ee87616cb
8.0/en/os/i386/XFree86-Mesa-libGL-4.2.1-20.i386.rpm
4b2304052a6ef52e315e7d13044607df
8.0/en/os/i386/XFree86-Mesa-libGLU-4.2.1-20.i386.rpm
b6671415b3cfbdd9e6bf8b46e7375fcf
8.0/en/os/i386/XFree86-Xnest-4.2.1-20.i386.rpm
2dac01365800f3d00135dc1f357a43b3
8.0/en/os/i386/XFree86-Xvfb-4.2.1-20.i386.rpm
501ab86d7597f9f2378dce40dd7146fd
8.0/en/os/i386/XFree86-base-fonts-4.2.1-20.i386.rpm
38f584b4b9e6a6a501ae323bbf366c2c
8.0/en/os/i386/XFree86-cyrillic-fonts-4.2.1-20.i386.rpm
be757f89eb5ffe6903b35213b222e09c
8.0/en/os/i386/XFree86-devel-4.2.1-20.i386.rpm
c32f8893dd354cdaca7e20be56bc5290
8.0/en/os/i386/XFree86-doc-4.2.1-20.i386.rpm
77ebf291729828fe129a2f394e00bf06
8.0/en/os/i386/XFree86-font-utils-4.2.1-20.i386.rpm
41f2f99950f65bfe0528e00a6c6aa1fa
8.0/en/os/i386/XFree86-libs-4.2.1-20.i386.rpm
e8f4052121e7bd18494311614e14a759
8.0/en/os/i386/XFree86-tools-4.2.1-20.i386.rpm
4b01bcb29d802e023ab703cd11a3cfb9
8.0/en/os/i386/XFree86-truetype-fonts-4.2.1-20.i386.rpm
1cc9502e9a0e1526edd58e0aed2cd31c
8.0/en/os/i386/XFree86-twm-4.2.1-20.i386.rpm
6bedb659afe1d73e50dade694a0a8157
8.0/en/os/i386/XFree86-xauth-4.2.1-20.i386.rpm
e9a20db35fc1bb1053b664afa8fbc1ed
8.0/en/os/i386/XFree86-xdm-4.2.1-20.i386.rpm
259c43f6d24e109154a989147571e7ce
8.0/en/os/i386/XFree86-xfs-4.2.1-20.i386.rpm