Signature Detail
Short Name |
HTTP:STC:DL:XORG-PCF-BO |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
X.Org X Server PCF Font Parser Buffer Overflow |
Release Date |
2010/09/22 |
Update Number |
1777 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: X.Org X Server PCF Font Parser Buffer Overflow
This signature detects attempts to exploit a known vulnerability in the X.Org X Server. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server's process.
Extended Description
X.Org X Server is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers can exploit this issue to execute arbitrary code with the privileges of the server. Failed attacks will cause denial-of-service conditions. NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Server Multiple Local Privilege Escalation and Information Disclosure Vulnerabilities), but has been given its own record to better document the issue.
Affected Products
- Apple Mac OS X 10.4.11
- Apple Mac OS X 10.5.2
- Apple Mac OS X Server 10.4.11
- Apple Mac OS X Server 10.5.2
- Attachmate Reflection 13.0
- Attachmate Reflection 13.0.4
- Attachmate Reflection 13.0.5
- Attachmate Reflection 14.0
- Attachmate Reflection 14.0 SP1
- Attachmate Reflection for HP 14.0.5
- Attachmate Reflection for IBM 14
- Attachmate Reflection for IBM 14.0.5
- Attachmate Reflection for UNIX and OpenVMS 14.0.5
- Attachmate Reflection X 13.0
- Attachmate Reflection X 14.0
- Attachmate Reflection X 14.0.5
- Avaya CMS Server 12.0.0
- Avaya CMS Server 13.0.0
- Avaya CMS Server 13.1
- Avaya CMS Server 14.0
- Avaya Interactive Response 2.0
- Avaya Interactive Response 3.0
- Debian Linux 4.0 Alpha
- Debian Linux 4.0 Amd64
- Debian Linux 4.0 Arm
- Debian Linux 4.0 Hppa
- Debian Linux 4.0 Ia-32
- Debian Linux 4.0 Ia-64
- Debian Linux 4.0 M68k
- Debian Linux 4.0 Mips
- Debian Linux 4.0 Mipsel
- Debian Linux 4.0 Powerpc
- Debian Linux 4.0 S/390
- Debian Linux 4.0 Sparc
- Gentoo Linux
- HP HP-UX B.11.11
- HP HP-UX B.11.11
- HP HP-UX B.11.23
- HP HP-UX B.11.23
- HP HP-UX B.11.23
- HP HP-UX B.11.31
- HP HP-UX B.11.31
- IBM AIX 5.2
- IBM AIX 5.3
- IBM AIX 6.1
- Linux Terminal Server Project 4.2
- Mandriva Corporate Server 3.0.0
- Mandriva Corporate Server 3.0.0 X86 64
- Mandriva Corporate Server 4.0
- Mandriva Corporate Server 4.0.0 X86 64
- Mandriva Linux Mandrake 2007.0
- Mandriva Linux Mandrake 2007.0 X86 64
- Mandriva Linux Mandrake 2007.1
- Mandriva Linux Mandrake 2007.1 X86 64
- Mandriva Linux Mandrake 2008.0
- Mandriva Linux Mandrake 2008.0 X86 64
- NoMachine NX Server 3.1.0
- NoMachine nx-X11 3.1.0-3
- OpenBSD 4.1
- OpenBSD 4.2
- Red Hat Advanced Workstation for the Itanium Processor 2.1.0
- Red Hat Advanced Workstation for the Itanium Processor 2.1.0 IA64
- Red Hat Desktop 3.0.0
- Red Hat Desktop 4.0.0
- Red Hat Enterprise Linux 5 Server
- Red Hat Enterprise Linux AS 2.1
- Red Hat Enterprise Linux AS 2.1 IA64
- Red Hat Enterprise Linux AS 3
- Red Hat Enterprise Linux AS 4
- Red Hat Enterprise Linux Desktop 5 Client
- Red Hat Enterprise Linux Desktop Workstation 5 Client
- Red Hat Enterprise Linux ES 2.1
- Red Hat Enterprise Linux ES 2.1 IA64
- Red Hat Enterprise Linux ES 3
- Red Hat Enterprise Linux ES 4
- Red Hat Enterprise Linux Virtualization 5 Server
- Red Hat Enterprise Linux WS 2.1
- Red Hat Enterprise Linux WS 2.1 IA64
- Red Hat Enterprise Linux WS 3
- Red Hat Enterprise Linux WS 4
- Red Hat Fedora 7
- Red Hat Fedora 8
- rPath Appliance Platform Linux Service 1
- rPath rPath Linux 1
- Sun Solaris 10 Sparc
- Sun Solaris 10 X86
- Sun Solaris 8 Sparc
- Sun Solaris 8 X86
- Sun Solaris 9 Sparc
- Sun Solaris 9 X86
- SuSE Linux 10.1 Ppc
- SuSE Linux 10.1 X86
- SuSE Linux 10.1 X86-64
- SuSE Linux Personal 10.1
- SuSE Linux Professional 10.1
- SuSE Novell Linux POS 9
- SuSE Open-Enterprise-Server
- SuSE openSUSE 10.2
- SuSE openSUSE 10.3
- SuSE SUSE Linux Enterprise SDK 10.SP1
- SuSE SUSE Linux Enterprise SDK 9
- SuSE SUSE Linux Enterprise Server 10
- SuSE SUSE Linux Enterprise Server 10 SP1
- SuSE SUSE Linux Enterprise Server 8
- Ubuntu Ubuntu Linux 6.06 LTS Amd64
- Ubuntu Ubuntu Linux 6.06 LTS I386
- Ubuntu Ubuntu Linux 6.06 LTS Powerpc
- Ubuntu Ubuntu Linux 6.06 LTS Sparc
- Ubuntu Ubuntu Linux 6.10 Amd64
- Ubuntu Ubuntu Linux 6.10 I386
- Ubuntu Ubuntu Linux 6.10 Powerpc
- Ubuntu Ubuntu Linux 6.10 Sparc
- Ubuntu Ubuntu Linux 7.04 Amd64
- Ubuntu Ubuntu Linux 7.04 I386
- Ubuntu Ubuntu Linux 7.04 Powerpc
- Ubuntu Ubuntu Linux 7.04 Sparc
- Ubuntu Ubuntu Linux 7.10 Amd64
- Ubuntu Ubuntu Linux 7.10 I386
- Ubuntu Ubuntu Linux 7.10 Powerpc
- Ubuntu Ubuntu Linux 7.10 Sparc
- X.org LibXfont 1.3.1
- X.org X11R6 4.0
- X.org X11R6 5.1
- X.org X11R6 6.7.0 .0
- X.org X11R6 6.8.0
- X.org X11R6 6.8.1
- X.org X11R6 6.8.2
- X.org X11R6 6.9.0
- X.org X11R7 1.0.0
- X.org X11R7 1.0.1
- X.org X11R7 1.0.2
- X.org X11R7 1.1.1
- X.org X11R7 7.0
- X.org X11R7 7.1
- X.org X11R7 7.2
- X.org xorg-server 1.02-R5
- X.org xorg-server 1.0.2-R6
- X.org xorg-server 1.2
- X.org xorg-server 1.3.99.2 (RC2)
- X.org xorg-server 1.4
- X.org Xserver 1.3.0
References
- BugTraq: 27352
- CVE: CVE-2008-0006