X11: DoS using XC-QUERY-SECURITY

This signature detects attempts to exploit a known vulnerability against XFree86, an open-source implementation of the X Windows System. Attackers can send the command string "XC-QUERY_SECURITY" to TCP/6000 on an X11 server. A successful attack can cause a denial-of-service (DoS) condition on the affected system.

Extended Description

A denial of service exists in XFree86 3.3.5, 3.3.6 and 4.0. A remote user can send a malformed packet to the TCP listening port, 6000, which will cause the X server to be unresponsive for some period of time. During this time, the keyboard will not respond to user input, and in some cases, the mouse will also not respond. During this time period, the X server will utilize 100% of the CPU, and can only be repaired by being signaled. This vulnerability exists only in servers compiled with the XCSECURITY #define set. This can be verified by running the following: strings /path/to/XF86_SVGA | grep "XC-QUERY-SECURITY-1" To quote the Bugtraq post, by Chris Evans : "Observe xc/programs/Xserver/os/secauth.c, AuthCheckSitePolicy(): // dataP is user supplied data from the network char *policy = *dataP; int nPolicies; ... // Oh dear, we can set nPolicies to -1 nPolicies = *policy++; while (nPolicies) { // Do some stuff in a loop ... nPolicies--; } So, the counter "nPolicies", if seeded with -1, will decrement towards about minus 2 billion, then wrap to become positive 2 billion, and head towards its final destination of 0."

Affected Products

Xfree86 x11r6

References

BugTraq: 1235

CVE: CVE-2000-0453

Short Name

X11:X11-XC-QUERY-SECURITY

Severity

Major

Recommended

False

Recommended Action

Drop

X11: DoS using XC-QUERY-SECURITY

Extended Description

Affected Products

References

Found a potential security threat?