Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:STC:DL:XORG-PCF-BO |
|---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
X.Org X Server PCF Font Parser Buffer Overflow |
Release Date |
2010/09/22 |
Update Number |
1777 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: X.Org X Server PCF Font Parser Buffer Overflow
This signature detects attempts to exploit a known vulnerability in the X.Org X Server. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server's process.
Extended Description
X.Org X Server is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers can exploit this issue to execute arbitrary code with the privileges of the server. Failed attacks will cause denial-of-service conditions. NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Server Multiple Local Privilege Escalation and Information Disclosure Vulnerabilities), but has been given its own record to better document the issue.
Affected Products
- Apple mac_os_x 10.4.11
- Apple mac_os_x 10.5.2
- Apple mac_os_x_server 10.4.11
- Apple mac_os_x_server 10.5.2
- Attachmate reflection 13.0
- Attachmate reflection 13.0.4
- Attachmate reflection 13.0.5
- Attachmate reflection 14.0
- Attachmate reflection 14.0 SP1
- Attachmate reflection_for_hp 14.0.5
- Attachmate reflection_for_ibm 14
- Attachmate reflection_for_ibm 14.0.5
- Attachmate reflection_for_unix_and_openvms 14.0.5
- Attachmate reflection_x 13.0
- Attachmate reflection_x 14.0
- Attachmate reflection_x 14.0.5
- Avaya cms_server 12.0.0
- Avaya cms_server 13.0.0
- Avaya cms_server 13.1
- Avaya cms_server 14.0
- Avaya interactive_response 2.0
- Avaya interactive_response 3.0
- Debian linux 4.0 Alpha
- Debian linux 4.0 Amd64
- Debian linux 4.0 Arm
- Debian linux 4.0 Hppa
- Debian linux 4.0 Ia-32
- Debian linux 4.0 Ia-64
- Debian linux 4.0 M68k
- Debian linux 4.0 Mips
- Debian linux 4.0 Mipsel
- Debian linux 4.0 Powerpc
- Debian linux 4.0 S/390
- Debian linux 4.0 Sparc
- Gentoo linux
- Hp hp-ux B.11.11
- Hp hp-ux B.11.11
- Hp hp-ux B.11.23
- Hp hp-ux B.11.23
- Hp hp-ux B.11.23
- Hp hp-ux B.11.31
- Hp hp-ux B.11.31
- Ibm aix 5.2
- Ibm aix 5.3
- Ibm aix 6.1
- Linux_terminal_server_project linux_terminal_server_project 4.2
- Mandriva corporate_server 3.0.0
- Mandriva corporate_server 3.0.0 X86 64
- Mandriva corporate_server 4.0
- Mandriva corporate_server 4.0.0 X86 64
- Mandriva linux_mandrake 2007.0
- Mandriva linux_mandrake 2007.0 X86 64
- Mandriva linux_mandrake 2007.1
- Mandriva linux_mandrake 2007.1 X86 64
- Mandriva linux_mandrake 2008.0
- Mandriva linux_mandrake 2008.0 X86 64
- Nomachine nx_server 3.1.0
- Nomachine nx-x11 3.1.0-3
- Openbsd openbsd 4.1
- Openbsd openbsd 4.2
- Red_hat advanced_workstation_for_the_itanium_processor 2.1.0
- Red_hat advanced_workstation_for_the_itanium_processor 2.1.0 IA64
- Red_hat desktop 3.0.0
- Red_hat desktop 4.0.0
- Red_hat enterprise_linux 5 Server
- Red_hat enterprise_linux_as 2.1
- Red_hat enterprise_linux_as 2.1 IA64
- Red_hat enterprise_linux_as 3
- Red_hat enterprise_linux_as 4
- Red_hat enterprise_linux_desktop 5 Client
- Red_hat enterprise_linux_desktop_workstation 5 Client
- Red_hat enterprise_linux_es 2.1
- Red_hat enterprise_linux_es 2.1 IA64
- Red_hat enterprise_linux_es 3
- Red_hat enterprise_linux_es 4
- Red_hat enterprise_linux_virtualization 5 Server
- Red_hat enterprise_linux_ws 2.1
- Red_hat enterprise_linux_ws 2.1 IA64
- Red_hat enterprise_linux_ws 3
- Red_hat enterprise_linux_ws 4
- Red_hat fedora 7
- Red_hat fedora 8
- Rpath appliance_platform_linux_service 1
- Rpath rpath_linux 1
- Sun solaris 10 Sparc
- Sun solaris 10 X86
- Sun solaris 8 Sparc
- Sun solaris 8 X86
- Sun solaris 9 Sparc
- Sun solaris 9 X86
- Suse linux 10.1 Ppc
- Suse linux 10.1 X86
- Suse linux 10.1 X86-64
- Suse linux_personal 10.1
- Suse linux_professional 10.1
- Suse novell_linux_pos 9
- Suse open-enterprise-server
- Suse opensuse 10.2
- Suse opensuse 10.3
- Suse suse_linux_enterprise_sdk 10.SP1
- Suse suse_linux_enterprise_sdk 9
- Suse suse_linux_enterprise_server 10
- Suse suse_linux_enterprise_server 10 SP1
- Suse suse_linux_enterprise_server 8
- Ubuntu ubuntu_linux 6.06 LTS Amd64
- Ubuntu ubuntu_linux 6.06 LTS I386
- Ubuntu ubuntu_linux 6.06 LTS Powerpc
- Ubuntu ubuntu_linux 6.06 LTS Sparc
- Ubuntu ubuntu_linux 6.10 Amd64
- Ubuntu ubuntu_linux 6.10 I386
- Ubuntu ubuntu_linux 6.10 Powerpc
- Ubuntu ubuntu_linux 6.10 Sparc
- Ubuntu ubuntu_linux 7.04 Amd64
- Ubuntu ubuntu_linux 7.04 I386
- Ubuntu ubuntu_linux 7.04 Powerpc
- Ubuntu ubuntu_linux 7.04 Sparc
- Ubuntu ubuntu_linux 7.10 Amd64
- Ubuntu ubuntu_linux 7.10 I386
- Ubuntu ubuntu_linux 7.10 Powerpc
- Ubuntu ubuntu_linux 7.10 Sparc
- X.org libxfont 1.3.1
- X.org x11r6 4.0
- X.org x11r6 5.1
- X.org x11r6 6.7.0 .0
- X.org x11r6 6.8.0
- X.org x11r6 6.8.1
- X.org x11r6 6.8.2
- X.org x11r6 6.9.0
- X.org x11r7 1.0.0
- X.org x11r7 1.0.1
- X.org x11r7 1.0.2
- X.org x11r7 1.1.1
- X.org x11r7 7.0
- X.org x11r7 7.1
- X.org x11r7 7.2
- X.org xorg-server 1.02-R5
- X.org xorg-server 1.0.2-R6
- X.org xorg-server 1.2
- X.org xorg-server 1.3.99.2 (RC2)
- X.org xorg-server 1.4
- X.org xserver 1.3.0
References
- BugTraq: 27352
- CVE: CVE-2008-0006