Bugzilla Bug 78118

Erik Sj

Erik Sjölund discovered that programs linked against xview are
vulnerable to a number of buffer overflows in the XView library.  When
the overflow is triggered in a program which is installed setuser root
a malicious user could perhaps execute arbitrary code as privileged
user.

These commands will create a segmentation fault:

$ ln -s  /usr/X11R6/bin/xvmount  /tmp/`perl -e 'print "A" x 200'`
$  /tmp/`perl -e 'print "A" x 200'`  -Wt

The overflowed variable seems to be sufficiently far away from the
stack frame, but I'm not totally sure that it is impossible to
overwrite it as well.  I'm attaching a proposed patch.

Please let me know if you need coordination for this bug.
This package is probably part of most other distributions as well.

Created an attachment (id=48564) [details]
CAN-2005-0076.patch

My system lacks the /usr/X11R6/bin/xvmount but does have xview so I'm not sure
if we are effected or not. Do you have the util?

n/m found it but it fails to even compile for me in the first place so can't
test.

pkg does not seem to be owned by any official herd or have a clear maintainer
listed in a metadata.xml. The last ebuild seems to be initially provided by
genstef. adding to CC:

genstef please test but do not put this patch into CVS until a disclosure date
is reached

I think we will just update the debin patch here as soon as they commit it, I
suppose they also know about it?

I think I am not the best man for testing it, I do not even use xview, so i
remove myself from CC:

I tagree that we should not disclose the details of this bug for now.

Not sure we should accept this one. If we don't have xvmount, or any other SUID
root linked to xview, then we should drop this as INVALID.

We don't have xvmount (or I can't find it). Depending on xview we just have :
    media-sound/workman
    app-editors/jove (if USE=X)

None of this is SUID root or SUID whatever. Closing this bug as INVALID, even if it should still be fixed when the Debian patch will be updated.

Please reopen if you disagree.

*** Bug 81505 has been marked as a duplicate of this bug. ***

(re)opening since debian issued http://www.debian.org/security/2005/dsa-672
so a new patchset is available now

Guess we should apply that, eventhough we are not directly affected

I actualy use xview all the time, i would not like to see this dead. I've been
watching the debian patch and the it seems that most of it is about Alpha
compatibility, so if i'm to try and solve this do you guys think we should use
the debian patch or just the one here?

Created an attachment (id=51380) [details]
xview-3.2-r1.ebuild.patch

Well after looking at the ebuild it seems we already use the debian patches :)
So here goes a patch to our ebuild, it simply changes the patchset. It builds
ok and works on x86.

Humpback: please commit your fix incvs, as it seems you're the only one to use
xview anyway :)

-r3 is in portage marked x86, there was a problem with -r2 that it would not
build with recent versions of xorg.
Credits must go to seemant for finding the new home for the package.

alpha, hppa: please test and mark stable. Will be closed without a GLSA since
we don't ship SUID xview-powered apps.

Alpha needs som PIC love before it can be marked stable.

Here's the part of emerge log with the errors, just in case anybody else wants to take a poke at this bug :)

a - wmgr_menu.o
a - wmgr_decor.o
make[4]: Leaving directory `/var/tmp/portage/xview-3.2-r3/work/xview-3.2p1.4-18c/lib/libxview/wmgr'
rm -f libxview.so.3.2.4~
(cd ./xshared; alpha-unknown-linux-gnu-gcc -shared -Wl,-soname -Wl,`basename libxview.so.3.2.4 | sed 's/\(\.[0-9]\).*$/\1/'` -o
libxview.so.3.2.4~ ?*.o -L/usr/X11R6/lib   -lXext  -lX11 -lutil -L../../libolgx -lolgx -lc)
/usr/lib/gcc-lib/alpha-unknown-linux-gnu/3.3.2/../../../../alpha-unknown-linux-gnu/bin/ld: csr_change.o: gp-relative relocation
against dynamic symbol ttysw_gray17_pr
/usr/lib/gcc-lib/alpha-unknown-linux-gnu/3.3.2/../../../../alpha-unknown-linux-gnu/bin/ld: csr_change.o: gp-relative relocation
against dynamic symbol ttysw_gray17_pr
collect2: ld returned 1 exit status
make[3]: *** [libxview.so.3.2.4] Error 1
make[3]: Leaving directory `/var/tmp/portage/xview-3.2-r3/work/xview-3.2p1.4-18c/lib/libxview'
make[2]: *** [all] Error 1
make[2]: Leaving directory `/var/tmp/portage/xview-3.2-r3/work/xview-3.2p1.4-18c/lib'
make[1]: *** [all] Error 1
make[1]: Leaving directory `/var/tmp/portage/xview-3.2-r3/work/xview-3.2p1.4-18c'
make: *** [World] Error 2

any progress on alpha yet?

Contacted kloeri -- he will try to get this one done soon.

kloeri any news on this one yet?

Finally gave in and -alpha'ed the xview ebuilds.

yeepee.

GMsoft and KillerFox haven't been able to get xview working on hppa. I propose
that we'll remove the hppa keyword from all ebuilds until it works again.

No problem for me.

Removed from hppa.