[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 18 May 2021 16:03:17 +0000
From: Unparalleled IT Security Research <info@...aralleled.eu>
To: oss-security@...ts.openwall.com
Subject: libx11 API Protocol Command Injection
Hello list,
Due to missing request length checks in libX11 injection of X
protocol commands is possible, e.g. by using long color names
in color lookup API calls. The color names in some cases may
be (remotely) attacker controlled, e.g. when xterm receives OCS
(operating system command sequences) from an SSH session to
a compromised server or a careless "tail -f" on a log file containing
OCS. A crafted OCS color name can be used to disable X server
authentication, mess up the keyboard layout, ...
Luckily only very few data flow pathes were found to trigger
such bogus color lookup calls. Color specifications in PDF, HTML,
SVG, ... were not suitable to reach the API in a problematic way
for those applications tested.
See the attached UNPAR-2021-1 advisory or the blog entry describing
how exploitation works in detail:
https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/
Kind regards,
| | DI Roman Fiedler
| / roman.fiedler at unparalleled.eu +43 677 63 29 28 29
/ | Unparalleled IT Services e.U. FN: 516074h VAT: ATU75050524
| | https://unparalleled.eu/ Felix-Dahn-Platz 4, 8010 Graz, Austria
View attachment "advisory-unpar-2021-1.txt" of type "text/plain" (11000 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
