发布日期：2004-09-17
更新日期：2004-09-23

受影响系统：

OpenBSD OpenBSD 3.5
OpenBSD OpenBSD 3.4
XFree86 X11R6 4.2.1
XFree86 X11R6 4.2.0
XFree86 X11R6 4.1.0
XFree86 X11R6 4.1-12
XFree86 X11R6 4.1-11
XFree86 X11R6 4.0.3
XFree86 X11R6 4.0.2-11
XFree86 X11R6 4.0.1
XFree86 X11R6 4.0
XFree86 X11R6 3.3.6
X.org X11R6 6.8
X.org X11R6 6.7.0
XFree86 X11R6 4.3
    - Mandrake Linux 9.2
    - Mandrake Linux 9.1
    - RedHat Fedora Core1
    - RedHat Linux 9.0
    - Slackware Linux 9.1
    - Slackware Linux 9.0

不受影响系统：

X.org X11R6 6.8.1

描述：

---

BUGTRAQ  ID: 11196
CVE(CAN) ID: CVE-2004-0687,CVE-2004-0688

libXpm是一款对XPM进行解码的库系统。

libXpm多处不正确检查边界缓冲区长度，远程攻击者可以利用这个漏洞可能以用户进程权限执行任意指令。

问题一是xpmParseColors (parse.c)中的堆栈缓冲区溢出：

XPMv1和XPMv2/3解析代码中不安全使用strcat()，可导致缓冲区溢出。

第二个问题是xpmParseColors (parse.c)中分配colorTable存在整数溢出问题，问题存在于如下：

colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));

ncolors可来自不可信的XPM文件。

第三个问题是ParseAndPutPixels (create.c)读取象素时存在堆栈缓冲区溢出。

构建恶意的XPM文件，诱使用户访问可导致以用户进程权限执行任意指令。

<*来源：chris （chris@cr-secure.net）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=109530851323415&w=2
        http://www.debian.org/security/2004/dsa-548
        http://www.linux-mandrake.com/en/security/2004/2004-099.php
        *>

建议：

---

厂商补丁：

Debian
------
http://www.debian.org/security/2004/dsa-548

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2004:099）以及相应补丁:
MDKSA-2004:099：Updated XFree86 packages fix libXpm overflow vulnerabilities
链接：http://www.linux-mandrake.com/en/security/2004/2004-099.php

补丁下载：

Updated Packages:

Mandrakelinux 10.0:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libxfree86-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libxfree86-devel-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libxfree86-static-devel-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-100dpi-fonts-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-75dpi-fonts-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-cyrillic-fonts-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-doc-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-glide-module-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-server-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-xfs-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-Xnest-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/XFree86-Xvfb-4.3-32.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/SRPMS/XFree86-4.3-32.2.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/SRPMS/XFree86-4.3-32.2.100mdk.src.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64xfree86-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64xfree86-devel-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64xfree86-static-devel-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-100dpi-fonts-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-75dpi-fonts-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-cyrillic-fonts-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-doc-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-server-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-xfs-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-Xnest-4.3-32.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/XFree86-Xvfb-4.3-32.2.100mdk.amd64.rpm

Corporate Server 2.1:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-100dpi-fonts-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-cyrillic-fonts-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-devel-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-libs-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-75dpi-fonts-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-doc-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-server-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-glide-module-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-static-libs-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-xfs-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-Xnest-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/XFree86-Xvfb-4.2.1-6.10.C21mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/SRPMS/XFree86-4.2.1-6.10.C21mdk.src.rpm

Corporate Server 2.1/x86_64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-static-libs-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-devel-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-doc-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-xfs-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-100dpi-fonts-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-75dpi-fonts-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-cyrillic-fonts-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-libs-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-server-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-Xnest-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/RPMS/XFree86-Xvfb-4.2.1-6.10.C21mdk.x86_64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/x86_64/corporate/2.1/SRPMS/XFree86-4.2.1-6.10.C21mdk.src.rpm

Mandrakelinux 9.2:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libxfree86-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libxfree86-devel-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-100dpi-fonts-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-cyrillic-fonts-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-xfs-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libxfree86-static-devel-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-75dpi-fonts-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-glide-module-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-doc-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-server-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-Xnest-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/XFree86-Xvfb-4.3-24.5.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/SRPMS/XFree86-4.3-24.5.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64xfree86-devel-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/XFree86-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64xfree86-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64xfree86-static-devel-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/XFree86-100dpi-fonts-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/XFree86-75dpi-fonts-4.3-24.5.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/XFree86-cyrillic-fonts-4.3-24.5.92mdk.amd64.rpm

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

S.u.S.E.
--------
S.u.S.E.已经为此发布了一个安全公告（SUSE-SA:2004:034）以及相应补丁:
SUSE-SA:2004:034：XFree86-libs, xshared

补丁下载：

SuSE Upgrade XFree86-libs-4.3.99.902-43.31.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.902-43.31.i586.rpm

SuSE Patch XFree86-libs-4.3.99.902-43.31.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.902-43.31.i586.patch.rpm

SuSE Upgrade XFree86-libs-4.3.0.1-55.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-55.i586.rpm

SuSE Patch XFree86-libs-4.3.0.1-55.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-55.i586.patch.rpm

SuSE Upgrade XFree86-libs-4.3.0-127.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-127.i586.rpm

SuSE Patch XFree86-libs-4.3.0-127.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-127.i586.patch.rpm

SuSE Upgrade XFree86-libs-4.3.99.902-43.31.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.99.902-43.31.x86_64.rpm

SuSE Patch XFree86-libs-4.3.99.902-43.31.x86_64.patch.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.99.902-43.31.x86_64.patch.rpm

SuSE Upgrade XFree86-libs-4.3.0.1-55.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0.1-55.x86_64.rpm

SuSE Patch XFree86-libs-4.3.0.1-55.x86_64.patch.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0.1-55.x86_64.patch.rpm

浏览次数：3680
严重程度：1（网友投票）