XFree86 X11r6 up to 4.0.3 xdm FORWARD_QUERY Request memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in XFree86 X11r6 up to 4.0.3. This issue affects some unknown processing of the component xdm. Performing a manipulation as part of FORWARD_QUERY Request results in memory corruption. This vulnerability is identified as CVE-2000-0491. The attack can be initiated remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in XFree86 X11r6 up to 4.0.3. This affects some unknown functionality of the component xdm. The manipulation as part of a FORWARD_QUERY Request leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request.

The weakness was released 05/24/2000 by Chris Evans as not defined advisory (Website). It is possible to read the advisory at ftp.calderasystems.com. This vulnerability is uniquely identified as CVE-2000-0491. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/13/2024).

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 13885 (Mandrake Linux Security Advisory : gdm (MDKSA-2001:070)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Mandriva Local Security Checks.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (19947), Tenable (13885) and SecurityFocus (BID 1370†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• XFree86

Name

• X11r6

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion