Debian alert: New xfree86 packages fix multiple vulnerabilities

CAN-2004-0083: Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CAN-2004-0084. CAN-2004-0084: Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CAN-2004-0083.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 443-1                     security@debian.org
http://www.debian.org/security/                             Matt Zimmerman
February 19th, 2004                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : xfree86
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2003-0690 CAN-2004-0083 CAN-2004-0084 CAN-2004-0106 CAN-2004-0093 CAN-2004-0094

A number of vulnerabilities have been discovered in XFree86:

 CAN-2004-0083: Buffer overflow in ReadFontAlias from dirfile.c of
    XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to
    execute arbitrary code via a font alias file (font.alias) with a long
    token, a different vulnerability than CAN-2004-0084.

 CAN-2004-0084: Buffer overflow in the ReadFontAlias function in XFree86
    4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows
    local or remote authenticated users to execute arbitrary code via a
    malformed entry in the font alias (font.alias) file, a different
    vulnerability than CAN-2004-0083.

 CAN-2004-0106: Miscellaneous additional flaws in XFree86's handling of
    font files.

 CAN-2003-0690: xdm does not verify whether the pam_setcred function call
    succeeds, which may allow attackers to gain root privileges by
    triggering error conditions within PAM modules, as demonstrated in
    certain configurations of the MIT pam_krb5 module.

 CAN-2004-0093, CAN-2004-0094: Denial-of-service attacks against the X
    server by clients using the GLX extension and Direct Rendering
    Infrastructure are possible due to unchecked client data (out-of-bounds
    array indexes [CAN-2004-0093] and integer signedness errors
    [CAN-2004-0094]).

Exploitation of CAN-2004-0083, CAN-2004-0084, CAN-2004-0106,
CAN-2004-0093 and CAN-2004-0094 would require a connection to the X
server.  By default, display managers in Debian start the X server
with a configuration which only accepts local connections, but if the
configuration is changed to allow remote connections, or X servers are
started by other means, then these bugs could be exploited remotely.
Since the X server usually runs with root privileges, these bugs could
potentially be exploited to gain root privileges.

No attack vector for CAN-2003-0690 is known at this time.

For the stable distribution (woody) these problems have been fixed in
version 4.1.0-16woody3.

For the unstable distribution (sid) these problems have been fixed in
version 4.3.0-2.

We recommend that you update your xfree86 package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.