Bug 959074 - (CVE-2013-1992) CVE-2013-1992 libdmx: Multiple integer overflows leading to heap-based bufer overflows
CVE-2013-1992 libdmx: Multiple integer overflows leading to heap-based bufer ...
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 966819 1078047
Blocks: 959130
  Show dependency treegraph
Reported: 2013-05-03 02:08 EDT by Huzaifa S. Sidhpurwala
Modified: 2014-10-22 02:37 EDT (History)
13 users (show)

See Also:
Fixed In Version: libdmx 1.1.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-10-21 03:00:57 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Huzaifa S. Sidhpurwala 2013-05-03 02:08:26 EDT
Multiple integer overflows leading to heap-based buffer overflows were found in the libdmx, an The X.Org X11 DMX (Distributed Multihead X) runtime library.. When a X client is connected to a malicious X server, (modified to return invalid values), it can cause arbirary code execution with the privileges of the user running the X client.

      Affected functions:  DMXGetScreenAttributes(), DMXGetWindowAttributes(),
Comment 3 Peter Hutterer 2013-05-05 22:07:51 EDT
Created attachment 743959 [details]
Comment 9 Jan Lieskovsky 2013-05-23 11:42:09 EDT
Public via:
Comment 10 Huzaifa S. Sidhpurwala 2013-05-23 23:52:09 EDT
Created libdmx tracking bugs for this issue

Affects: fedora-all [bug 966819]
Comment 11 Fedora Update System 2013-05-28 23:02:43 EDT
libdmx-1.1.2-4.20130524git5074d9d64.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2013-06-02 23:10:06 EDT
libdmx-1.1.2-4.20130524git5074d9d64.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Huzaifa S. Sidhpurwala 2013-06-04 23:34:37 EDT
This issue affects the version of libdmx as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 15 Jan Lieskovsky 2013-06-17 09:03:45 EDT
External References:

Comment 17 AU Admin 2013-09-17 10:00:43 EDT
When will a Red Hat Enterprise Linux 5 update be available in the YUM repository Beta or otherwise? I've searched all repos in RHEL's Customer Portal. This shows as a Retina security scanner vulnerability.

Further investigation shows updated patches were released for
RHEL 6, Fedora 20, Fedora 19 and Fedora 18 but NOTHING in Beta nor any other
updates beyond the version shipped with RHEL 5. A reference source for Linux Packages for O/S: http://pkgs.org/download/libdmx
Comment 23 Vincent Danen 2014-08-08 09:50:46 EDT

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This flaw only affects X clients that connect to malicious X servers.  Generally speaking, these will be untrusted/unknown X servers only, as trusted remote X servers should be connected to via SSH (which provides end-point verification and authentication), or the local X server.  Because this flaw requires that the X server be changed (recompiled to deviate from a standard X server) in order to impact the X client, it requires root privileges on the X server to effect the change.  If this is a system where the X client and server are on the same (local) host, and an attacker is able to replace the X server binary, then they already have root privileges and no trust boundary is crossed.  With remote X servers, using SSH with strict host-key checking will prevent the X client from connecting to the X server without intervention, as the user will be alerted to host-key changes.
Comment 24 Huzaifa S. Sidhpurwala 2014-10-21 03:00:57 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1436 https://rhn.redhat.com/errata/RHSA-2014-1436.html

Note You need to log in before you can comment on or make changes to this bug.