CERT^® Advisory CA-1997-11 Vulnerability in libXt

A complete revision history is at the end of this file.

There have been discussions on public mailing lists about buffer overflows in the Xt library of the X Windowing System made freely available by The Open Group (and previously by the now-defunct X Consortium). The specific problem outlined in those discussions was a buffer overflow condition in the Xt library, and the file xc/lib/Xt/Error.c. Exploitation scripts were made available.

Since then (the latter half of 1996), The Open Group has extensively reviewed the source code for the entire distribution to address the potential for further buffer overflow conditions. These conditions can make it possible for a local user to execute arbitrary instructions as a privileged user without authorization.

The programs that pose a potential threat to sites are those programs that have been built from source code prior to X11 Release 6.3 and have setuid or setgid bits set. Some third-party vendors distribute derivatives of the X Window System, and if you use a distribution that includes X tools that have setuid or setgid bits set, you may be vulnerable as well.

The CERT/CC team recommends upgrading to X11 Release 6.3 or installing a patch from your vendor. If you cannot do one of these, then as a last resort we recommend that you remove the setuid or setgid bits from any executable files contained in your distribution of X; this may have an adverse effect on some system operations.

We will update this advisory as we receive additional information. Please check advisory files regularly for updates that relate to your site.

I. Description

The specific problem outlined in those discussions was a buffer overflow condition in the Xt library and the file xc/lib/Xt/Error.c. It was possible for a user to execute arbitrary instructions as a privileged user using a program built by this distribution with setuid or setgid bits set.

Note that in this case a root compromise was only possible when programs built from this distribution (e.g., xterm) were setuid root.
Since then The Open Group has extensively reviewed the source code for the entire distribution to address the potential for further buffer overflow condition.

If you use a distribution of the X Windowing System earlier than X11 Release 6.3 that you downloaded and compiled yourself, we encourage you to take the steps outlined in either Section IV A or C.

If you use third-party vendor-supplied distributions of the X Windowing System containing setuid root programs, we encourage you to take the steps outlined in Sections IV B or C.

** Note: Discussions of this specific instance of the vulnerability appeared on mailing lists during the second half of 1996. Exploitation scripts were made public at that time.

II. Impact

III. Finding Potentially Vulnerable Distributions

A. For Sites That Download and Build Their Own Distributions

Sites that have downloaded the X source code from the X Consortium should be able to identify such programs by looking in the directory hierarchy defined by the "ProjectRoot" constant described in the xc/config/cf/site.def file in the source code distribution. The default is /usr/X11R6.3. The X11R6.3 Installation Guide states:

"ProjectRoot

The destination where X will be installed. This variable needs to be set before you build, as some programs that read files at run-time have the installation directory compiled in to them. Assuming you have set the variable to some value /path, files will be installed into /path/bin, /path/include/X11, /path/lib, and /path/man."

B. For Vendor-Supplied Distributions

If you use a distribution that does not have setuid or setgid bits enabled on any X tools, then you do not need to take any of the steps listed below.

Below is a list of vendors who have provided information about this problem. If your vendor's name is not on this list and you need clarification, you should check directly with your vendor.

IV. Solution

For distributions that were built directly from the source code supplied by The Open Group (and previously by the X Consortium), we encourage you to apply either Solutions A or C. For vendor-supplied distributions, we encourage you to apply either Solutions B or C.

A. Upgrade to X11 Release 6.3

ftp://ftp.x.org/pub/R6.3/tars/xc-1.tar.gz
ftp://ftp.x.org/pub/R6.3/tars/xc-2.tar.gz
ftp://ftp.x.org/pub/R6.3/tars/xc-3.tar.gz

B. Install a patch from your vendor

Berkeley Software Design, Inc. (BSDI)
Data General Corporation
Digital Equipment Corporation (DEC)
FreeBSD, Inc.
Hewlett-Packard Company
IBM Corporation
NEC Corporation
NeXT Software, Inc.
The Open Group (formerly OSF/X Consortium)
The Santa Cruz Operation, Inc. (SCO)
Silicon Graphics, Inc.
Sun Microsystems, Inc.

C. Remove the setuid bit from affected programs

Note that this may have an adverse effect on some system operations. For instance, on some systems the xlock program needs to have the setuid bit enabled so that the shadow password file can be read to unlock the screen. By removing the setuid bit from this program, you remove the ability of the xlock program to read the shadow password file. This means that particular version of the xlock program should not be used at all, or it should be killed from another terminal when necessary.

Appendix A - Vendor Information

Berkeley Software Design, Inc. (BSDI)

Data General Corporation

All versions of DG/UX are vulnerable.

Patches for this vulnerability are in progress.

Digital Equipment Corporation (DEC)

FreeBSD, Inc.

Hewlett-Packard Company

Security Bulletins are available from the HP Electronic
Support Center via electronic mail.

Use your browser to get to the HP Electronic Support
Center page at:

http://us-support.external.hp.com (for US, Canada, Asia-Pacific, & Latin-America)

http://europe-support.external.hp.com (for Europe)

IBM Corporation

AIX 3.2

To determine if you have this PTF on your system, run the following command:
lslpp -lB U445908 U447740

AIX 4.1

To determine if you have this APAR on your system, run the following command:

instfix -ik IX61031 IX66736 IX66449

Or run the following command:

lslpp -h X11.base.lib

Your version of X11.base.lib should be 4.1.5.2 or later.

AIX 4.2

APAR - IX66824 IX66352

To determine if you have this APAR on your system, run the following command:

instfix -ik IX66824 IX66352

Or run the following command:

lslpp -h X11.base.lib

Your version of X11.base.lib should be 4.2.1.0 or later.

To Order

http://service.software.ibm.com/aixsupport/

or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".

IBM and AIX are registered trademarks of International Business Machines Corporation.

NEC Corporation

Patches for this vulnerability are in progress.
For further information, please contact by e-mail:

UX48-security-support@nec.co.jp

NeXT Software, Inc.

The Open Group (formerly OSF/X Consortium)

The Santa Cruz Operation, Inc. (SCO)

Silicon Graphics, Inc.

For further information, please refer to Silicon Graphics Inc. Security Advisory Number: 19971101-01-PX, "libXt Security Issues."

The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its mirror, ftp.sgi.com. Security information and patches can be found in the ~ftp/security and ~ftp/patches directories, respectfully.

Sun Microsystems, Inc.

Patches are available to all Sun customers via World Wide Web at:

ftp://sunsolve1.sun.com/pub/patches/patches.html;

Customers with Sun support contracts can also obtain patches from local Sun answer centers and SunSITEs worldwide.

Sun security bulletins are available via World Wide Web at:

http://sunsolve1.sun.com/sunsolve/secbulletins

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 1997 Carnegie Mellon University.

Jan. 5, 1998  Added vendor information for Silicon Graphics, Inc.
Dec. 11, 1997 Appendix A - updated vendor information for Data General Corporation.
Sep. 26, 1997 Updated copyright statement
Aug. 27, 1997 Appendix A - updated vendor information for Sun Microsystems,Inc.
May 8, 1997   Appendix A - updated vendor information for Hewlett-Packard.