AUSCERT External Security Bulletin Redistribution

                 ESB-2001.057 -- FreeBSD-SA-01:07.xfree86
                  Multiple XFree86 3.3.6 vulnerabilities
                             14 February 2001


        AusCERT Security Bulletin Summary

Product:                XFree86
Vendor:                 FreeBSD Ports Collection
Operating System:       FreeBSD
Platform:               i386
Impact:                 Denial of Service
                        Increased Privileges
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------


FreeBSD-SA-01:07                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          Multiple XFree86 3.3.6 vulnerabilities

Category:       ports
Module:         XFree86-3.3.6, XFree86-aoutlibs
Announced:      2001-01-23
Credits:        Chris Evans <chris@ferret.lmh.ox.ac.uk>
                Michal Zalewski <lcamtuf@tpi.pl>
Affects:        Ports collection prior to the correction date.
Corrected:      2000-10-24 (XFree86-3.3.6)
Vendor status:  Fixed in XFree86 4.0.1, no patches released by vendor.
FreeBSD only:   NO

I.   Background

XFree86 is a popular X server.  It exists in three versions in the
FreeBSD ports collection: 3.3.6 and 4.0.2, as well as a.out libraries
based on XFree86 3.3.3.

II.  Problem Description

The XFree86-3.3.6 port, versions prior to 3.3.6_1, has multiple
vulnerabilities that may allow local or remote users to cause a denial
of service attack against a vulnerable X server.  Additionally, local
users may be able to obtain elevated privileges under certain

X server DoS:
  Remote users can, by sending a malformed packet to port 6000 TCP,
  cause the victim's X server to freeze for several minutes. During
  the freeze, the mouse does not move and the screen does not update
  in any way. In addition, the keyboard is unresponsive, including
  console-switch and kill-server key combinations. Non-X processes,
  such as remote command-line logins and non-X applications, are
  unaffected by the freeze.

Xlib holes:
  Due to various coding flaws in libX11, privileged (setuid/setgid)
  programs linked against libX11 may allow local users to obtain
  elevated privileges.

libICE DoS:
  Due to inadequate bounds checking in libICE, a denial of service
  exists with any application using libICE to listen on a network port
  for network services.

The XFree86-aoutlibs port contains the XFree86 libraries from the
3.3.3 release of XFree86, in a.out format suitable for use with
applications in the legacy a.out binaryformat, most notably being the
FreeBSD native version of Netscape.  It is unknown whether Netscape is
vulnerable to the problems described in this advisory, but it believed
that the only potential vulnerability is the libICE denial-of-service
condition described above.

The XFree86 and XFree86-aoutlibs ports are not installed by default
(although XFree86 is available as an installation option in the
FreeBSD installer), nor are they "part of FreeBSD" as such: they are
part of the FreeBSD ports collection, which contains almost 4500
third-party applications in a ready-to-install format.  The ports
collections shipped with FreeBSD 3.5.1 and 4.1.1 contain these problem
since they were discovered after the releases, but the XFree86 problem
was corrected prior to the release of FreeBSD 4.2.  At the time of
advisory release, the XFree86-aoutlibs port has not been corrected.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security
audit of the most security-critical ports.

III. Impact

Local or remote users may cause a denial of service attack against an
X server or certain X applications.  Local users may obtain elevated
privileges with certain X applications.

If you have not chosen to install the XFree86 3.3.6 port/package or
the XFree86-aoutlibs port/package, or you are running XFree86 4.0.1 or
later, then your system is not vulnerable to this problem.

IV.  Workaround

Deinstall the XFree86-3.3.6 and XFree86-aoutlibs ports/packages, if
you you have installed them.

Note that any statically linked binaries which make use of the
vulnerable XFree86 routines may still be vulnerable to the problems
after deinstallation of the port/package.  However due to the
difficulty of developing a reliable scanning utility for such binaries
no such utility is provided.

V.   Solution

One of the following:

1) Upgrade your entire ports collection and rebuild the XFree86-3.3.6

2) Deinstall the old package and install an XFree86-4.0.2 package
obtained from:


Packages are not automatically generated for the alpha architecture at
this time due to lack of build resources.

NOTE: XFree86-3.3.6 packages are no longer made available, only the
newer XFree86-4.0.2 packages.

Note also that the XFree86-aoutlibs port has not yet been fixed: there
is currently no solution to the problem other than removing the
port/package and recompiling any dependent software to use ELF
libraries, or switching to an ELF-based version of the software, if
available (e.g. the BSD/OS or Linux versions of Netscape, as an
alternative to the FreeBSD native version).  The potential impact of
the vulnerabilities to the local environment may be deemed not
sufficiently great to warrant this approach, however.

3) download a new port skeleton for the XFree86-3.3.6 port from:


and use it to rebuild the port.

4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:

Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org


- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key