-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
ESB-2003.0459 -- RHSA-2003:067-02
Updated XFree86 packages provide security and bug fixes
02 July 2003
AusCERT Security Bulletin Summary
Publisher: Red Hat
Operating System: Red Hat Linux 8.0
Impact: Execute Arbitrary Code/Commands
Denial of Service
CVE Names: CAN-2001-1409, CAN-2002-1472, CAN-2002-0164,
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated XFree86 packages provide security and bug fixes
Advisory ID: RHSA-2003:067-02
Issue date: 2003-06-25
Updated on: 2003-07-01
Product: Red Hat Linux
CVE Names: CAN-2001-1409 CAN-2002-1472 CAN-2002-0164 CAN-2003-0063 CAN-2003-0071
- - ---------------------------------------------------------------------
New XFree86 packages for Red Hat Linux 8.0 are now available which include
several security fixes, bug fixes, enhancements, and driver updates.
[Updated: June 30, 2003]
The XFree86 4.2.1-20 packages which were originally released in this
advisory were accidentally built with debugging info enabled due to a
temporary problem with our build system. Unfortunately, this problem was
not noticed during package testing, and caused the new XFree86 packages to
contain full debug symbol data, resulting in extremely large packages.
Note that the previously released packages are functional and should not
cause any problems on systems with adequate disk space. However we are
releasing new XFree86 4.2.1-21 packages to both minimize the download time
for people that have not yet updated XFree86 on their systems, and to
minimize the disk space footprint caused by this issue. Additionally, our
testing procedures have also been updated to automatically catch similar
issues in the future.
Red Hat apologizes for any inconvenience this may have caused you.
2. Relevant releases/architectures:
Red Hat Linux 8.0 - i386
3. Problem description:
XFree86 is an implementation of the X Window System providing the core
graphical user interface and video drivers in Red Hat Linux.
A number of security vulnerabilities have been discovered in XFree86 4.2.0:
- - - Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
- - - It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. (CAN-2003-0071)
- - - XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
- - - The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. (CAN-2001-1409)
Driver updates and additions:
- - - Savage driver updated to Tim Roberts' latest version 1.1.27t.
- - - Added new "cyrix" driver from Alan Cox, which works much better on
- - - Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit),
Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98
head tracker (ur98)
- - - Backported apm driver from XFree86 CVS, DPMS support enhancements, and a
few accel fixes
- - - Backported ark driver from XFree86 CVS
- - - Backported chips driver from XFree86 CVS, with hardware mouse
cursor and 2D accleration fixes.
- - - Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS
Various bug fixes and enhancements:
- - - Bug fixes for the RENDER extension and libraries which improve stability
- - - Various fixes to the Xaw library
- - - A long standing problem in the X server has been fixed in which
the mouse, keyboard, or video would hang, or the server to go into an
endless loop whenever the system time was changed backward while X was
- - - Fixed a bug in both the Radeon and Rage 128 drivers which caused
crashes while using VMware with DGA when DRI is enabled
- - - The Matrox "mga" driver had some problems with multihead and the RENDER
extension which have been worked around.
- - - fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
- - - mkfontdir has been modified to force the permissions of the files it
generates to be mode 0644 ensuring they are world readable independant of
- - - Added a new option "ForceLegacyCRT" to the radeon driver to allow use
of legacy VGA monitors which can not be detected automatically. This
option is only safe to use in single-head setups and may cause serious
problems if used with dual-head.
- - - xterm session management is now enabled by default, whereas the stock
XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
- - - Removed and obsoleted the XFree86-xtrap-clients package, and merged it
into the main XFree86 package to simplify packaging
There are various other fixes included which users can review by examining
the RPM package changelog of any of the new XFree86 packages.
Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
are not vulnerable to the previously mentioned security issues.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
63509 - mouse event problems after system standby
69978 - Radeon failure with old VGA monitor
72297 - MediaGX 5530 XFree86 failure
73678 - Screen corruption when running full-screen VMware under DRI-enabled XFree86
75155 - lndir doesn't work with relative symlink
76154 - Mozilla with xft crashes on Red Hat 8.0 (Xrender bug)
77542 - XFree86-truetype-fonts does integrate with Xft/fontconfig
77930 - rhPrintOSKernelString can print stack garbage
78804 - Xutf8LookupString fails in UTF-8 locale if X server lacks XKB support
79488 - XKeysymDB is included in XFree86.rpm whereas it should be in XFree86-libs.rpm
83303 - Unresolved DRM symbols in r128 driver (4.2.1)
84036 - xauth can write incomplete .xauth files
88773 - xterm session management is disabled by default in XFree86 4.2.x
6. RPMs required:
Red Hat Linux 8.0:
MD5 sum Package Name
- - --------------------------------------------------------------------------
These packages are GPG signed by Red Hat for security. Our key is
available from http://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
The Red Hat security contact is <firstname.lastname@example.org>. More contact
details at http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to email@example.com
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----