Date: Tue, 18 May 2021 16:03:17 +0000 From: Unparalleled IT Security Research <info@...aralleled.eu> To: oss-security@...ts.openwall.com Subject: libx11 API Protocol Command Injection Hello list, Due to missing request length checks in libX11 injection of X protocol commands is possible, e.g. by using long color names in color lookup API calls. The color names in some cases may be (remotely) attacker controlled, e.g. when xterm receives OCS (operating system command sequences) from an SSH session to a compromised server or a careless "tail -f" on a log file containing OCS. A crafted OCS color name can be used to disable X server authentication, mess up the keyboard layout, ... Luckily only very few data flow pathes were found to trigger such bogus color lookup calls. Color specifications in PDF, HTML, SVG, ... were not suitable to reach the API in a problematic way for those applications tested. See the attached UNPAR-2021-1 advisory or the blog entry describing how exploitation works in detail: https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/ Kind regards, | | DI Roman Fiedler | / roman.fiedler at unparalleled.eu +43 677 63 29 28 29 / | Unparalleled IT Services e.U. FN: 516074h VAT: ATU75050524 | | https://unparalleled.eu/ Felix-Dahn-Platz 4, 8010 Graz, Austria View attachment "advisory-unpar-2021-1.txt" of type "text/plain" (11000 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.