Bug 854915 (CVE-2013-6462) - VUL-0: CVE-2013-6462: xorg-x11: sscanf without bounds in libXfont bdfread.c
Summary: VUL-0: CVE-2013-6462: xorg-x11: sscanf without bounds in libXfont bdfread.c
Status: RESOLVED FIXED
: 882908 (view as bug list)
Alias: CVE-2013-6462
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-07-01
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp1:55677 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-11 10:47 UTC by Sebastian Krahmer
Modified: 2014-07-18 15:09 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
testcase font (6.79 KB, application/x-font-bdf)
2013-12-11 10:48 UTC, Sebastian Krahmer
Details
CVE-2013-XXX.txt (1.83 KB, text/plain)
2013-12-27 10:40 UTC, Marcus Meissner
Details
0001-CVE-2013-XXXX-unlimited-sscanf-can-overflow-stack-bu.patch (1.09 KB, patch)
2013-12-27 10:40 UTC, Marcus Meissner
Details | Diff
0002-Limit-additional-sscanf-strings-to-fit-buffer-sizes.patch (2.64 KB, patch)
2013-12-27 10:41 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2013-12-11 10:47:27 UTC
Via private list:

Looking through some cppcheck output on libXfont, I noticed a bunch of
warnings of the form:

[lib/libXfont/src/bitmap/bdfread.c:341]: (warning) scanf without field
width limits can crash with huge input data.

where we use sscanf to parse strings without specifying a length limit.
In most cases we appear to luck out because both input & output buffers are
1024 chars, but one case appears to allow overflow, which is easily fixed:

--- a/src/bitmap/bdfread.c
+++ b/src/bitmap/bdfread.c
@@ -338,7 +338,7 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileSt
        char        charName[100];
        int         ignore;

-       if (sscanf((char *) line, "STARTCHAR %s", charName) != 1) {
+       if (sscanf((char *) line, "STARTCHAR %99s", charName) != 1) {
            bdfError("bad character name in BDF file\n");
            goto BAILOUT;       /* bottom of function, free and return error */
        }

I made a bdf font that had ~800 characters there and ran on a test system:

mkfontdir .
xset +fp `pwd`
xfd -fn '-sun-bdftest startchar-----12-120-75-75-p-160-sunolcursor-1'
xlsfonts -lll -fn '-sun-bdftest startchar-----12-120-75-75-p-160-sunolcursor-1'
xlsatoms | grep bdfReadChar

and I could see that it had read the font & created an atom from the oversized
character name, but not crashed, so I guess my stack layout is lucky enough that
I didn't smash anything important.

Does anyone see anything I'm missing here?   This is a user-controllable buffer
overflow in our setuid-root X server, right?

        -alan-
Comment 1 Sebastian Krahmer 2013-12-11 10:48:52 UTC
Created attachment 571301 [details]
testcase font
Comment 2 Sebastian Krahmer 2013-12-11 10:51:17 UTC
and its EMBARGOED.
Comment 3 Stefan Dirsch 2013-12-20 11:25:59 UTC
Any news on that one?
Comment 4 Marcus Meissner 2013-12-20 12:15:30 UTC
a released date was not set yet, it will probably be in the new year
Comment 5 Stefan Dirsch 2013-12-20 12:52:25 UTC
Ok. And you believe this will be the official patch? I'm asking since there isn't anything yet in libXfont git master ...
Comment 6 Marcus Meissner 2013-12-20 14:02:33 UTC
no other version was discussed so far. 

we keep this bug updated if new stuff comes in ;)
Comment 7 Marcus Meissner 2013-12-27 10:40:23 UTC
Created attachment 572968 [details]
CVE-2013-XXX.txt

draft advisory by x.org
Comment 8 Marcus Meissner 2013-12-27 10:40:58 UTC
Created attachment 572969 [details]
0001-CVE-2013-XXXX-unlimited-sscanf-can-overflow-stack-bu.patch

patch 1 to fix the current issue
Comment 9 Marcus Meissner 2013-12-27 10:41:36 UTC
Created attachment 572970 [details]
0002-Limit-additional-sscanf-strings-to-fit-buffer-sizes.patch

sceond patch ... limit mor eof the sscanf present in the bdf parser
Comment 10 Sebastian Krahmer 2014-01-06 14:12:15 UTC
> sizes
>
> None of these could currently result in buffer overflow, as the
> input and output buffers were the same size, but adding limits
> helps ensure we keep it that way, if we ever resize any of these
> in the future.

This is being treated as security hardening, so no CVE.


> From aeabb3efa6905e11c479e2e5319f2b6b3ab22009 Mon Sep 17 00:00:00
> 2001 From: Alan Coopersmith <alan.coopersmith@oracle.com> Date:
> Mon, 23 Dec 2013 18:34:02 -0800 Subject: [PATCH:libXfont 1/2]
> CVE-2013-XXXX: unlimited sscanf can
overflow
> stack buffer in bdfReadCharacters()
>
> Fixes cppcheck warning: [lib/libXfont/src/bitmap/bdfread.c:341]:
> (warning) scanf without field width limits can crash with huge
> input data.

Please use CVE-2013-6462 for this issue. To note, this is also the
issue for which the security advisory applies.
Comment 11 Sebastian Krahmer 2014-01-08 08:48:52 UTC
Went public.

The final patch again is at:

http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=4d024ac10f964f6bd372ae0dd14f02772a6e5f63
Comment 14 Stefan Dirsch 2014-01-08 09:58:57 UTC
openSUSE_Factory/sle12: SR#213116
Comment 15 Bernhard Wiedemann 2014-01-08 10:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (854915) was mentioned in
https://build.opensuse.org/request/show/213116 Factory / libXfont
Comment 16 Swamp Workflow Management 2014-01-08 10:17:09 UTC
The SWAMPID for this issue is 55674.
This issue was rated as moderate.
Please submit fixed packages until 2014-01-22.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 20 Stefan Dirsch 2014-01-08 13:33:03 UTC
openSUSE 12.2/12.3/13.1: SR#213159
Comment 21 Stefan Dirsch 2014-01-08 13:41:18 UTC
Still maintained sle products:

sle11-sp3 --> xorg-x11-libs
sle11-sp2 --> xorg-x11-libs
sle11-sp1-x86_64 --> xorg-x11-libs
sle10-sp3-x86_64 --> xorg-x11-libs
sles9-sp3-teradata-x86_64 --> XFree86
Comment 22 Bernhard Wiedemann 2014-01-08 14:02:20 UTC
This is an autogenerated message for OBS integration:
This bug (854915) was mentioned in
https://build.opensuse.org/request/show/213159 13.1+12.2+12.3 / libXfont
Comment 23 Stefan Dirsch 2014-01-08 14:28:13 UTC
> sle11-sp3 --> xorg-x11-libs
> sle11-sp2 --> xorg-x11-libs
> sle11-sp1-x86_64 --> xorg-x11-libs

--> SR#30412
Comment 24 Stefan Dirsch 2014-01-08 14:36:24 UTC
> sle10-sp3-x86_64 --> xorg-x11-libs
Wrong, that's *xorg-x11*.
Comment 26 Stefan Dirsch 2014-01-08 15:14:57 UTC
sle10-sp3-x86_64/xorg-x11: SR#30413
Comment 28 Stefan Dirsch 2014-01-08 16:16:39 UTC
sles9-sp3-teradata-x86_64: SR#30415
Comment 29 Stefan Dirsch 2014-01-08 16:17:27 UTC
package updates done
Comment 31 Swamp Workflow Management 2014-01-15 16:06:15 UTC
openSUSE-SU-2014:0073-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 854915
CVE References: CVE-2013-6462
Sources used:
openSUSE 13.1 (src):    libXfont-1.4.6-2.4.1
openSUSE 12.3 (src):    libXfont-1.4.5-4.4.1
openSUSE 12.2 (src):    libXfont-1.4.5-2.4.1
Comment 32 Swamp Workflow Management 2014-01-15 17:05:04 UTC
openSUSE-SU-2014:0075-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 854915
CVE References: CVE-2013-6462
Sources used:
openSUSE 11.4 (src):    xorg-x11-libs-7.6-17.42.1
Comment 33 Marcus Meissner 2014-02-11 10:34:13 UTC
released
Comment 34 Swamp Workflow Management 2014-02-11 11:04:21 UTC
Update released for: xorg-x11-devel, xorg-x11-libs, xorg-x11-libs-debuginfo, xorg-x11-libs-debugsource
Products:
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 35 Swamp Workflow Management 2014-02-11 12:52:30 UTC
Update released for: xorg-x11-devel, xorg-x11-devel-32bit, xorg-x11-devel-64bit, xorg-x11-libs, xorg-x11-libs-32bit, xorg-x11-libs-64bit, xorg-x11-libs-debuginfo, xorg-x11-libs-debuginfo-32bit, xorg-x11-libs-debuginfo-64bit, xorg-x11-libs-debuginfo-x86, xorg-x11-libs-debugsource, xorg-x11-libs-x86
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 36 Swamp Workflow Management 2014-02-11 13:06:52 UTC
Update released for: xorg-x11-devel, xorg-x11-devel-32bit, xorg-x11-devel-64bit, xorg-x11-libs, xorg-x11-libs-32bit, xorg-x11-libs-64bit, xorg-x11-libs-debuginfo, xorg-x11-libs-debuginfo-32bit, xorg-x11-libs-debuginfo-64bit, xorg-x11-libs-debuginfo-x86, xorg-x11-libs-debugsource, xorg-x11-libs-x86
Products:
SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP2 (i386, x86_64)
SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP2 (i386, x86_64)
Comment 37 Swamp Workflow Management 2014-02-11 14:04:29 UTC
Update released for: xorg-x11, xorg-x11-Xnest, xorg-x11-Xprt, xorg-x11-Xvfb, xorg-x11-Xvnc, xorg-x11-debuginfo, xorg-x11-devel, xorg-x11-doc, xorg-x11-driver-options, xorg-x11-fonts-100dpi, xorg-x11-fonts-75dpi, xorg-x11-fonts-cyrillic, xorg-x11-fonts-scalable, xorg-x11-fonts-syriac, xorg-x11-libs, xorg-x11-man, xorg-x11-sdk, xorg-x11-server, xorg-x11-server-glx
Products:
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 38 Swamp Workflow Management 2014-02-11 14:04:50 UTC
Update released for: XFree86, XFree86-Mesa, XFree86-Mesa-devel, XFree86-Xnest, XFree86-Xprt, XFree86-Xvfb, XFree86-Xvnc, XFree86-devel, XFree86-doc, XFree86-driver-options, XFree86-fonts-100dpi, XFree86-fonts-75dpi, XFree86-fonts-cyrillic, XFree86-fonts-scalable, XFree86-fonts-syriac, XFree86-libs, XFree86-man, XFree86-server, XFree86-server-glx, km_drm
Products:
SUSE-CORE 9-SP3-TERADATA (x86_64)
Comment 39 Swamp Workflow Management 2014-02-11 17:04:26 UTC
SUSE-SU-2014:0219-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 854915
CVE References: CVE-2013-6462
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Software Development Kit 11 SP2 (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Server 11 SP3 (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Server 11 SP2 for VMware (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Server 11 SP2 (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    xorg-x11-libs-7.4-8.26.40.1
SUSE Linux Enterprise Desktop 11 SP2 (src):    xorg-x11-libs-7.4-8.26.40.1
Comment 40 Swamp Workflow Management 2014-06-17 08:06:00 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2014-07-01.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/57862
Comment 41 Marcus Meissner 2014-06-17 08:19:28 UTC
*** Bug 882908 has been marked as a duplicate of this bug. ***
Comment 42 Forgotten User jLwPs9ra3R 2014-06-17 16:52:52 UTC
Is there a release date/ETA for the LTSS package for SLES11SP1? I do not see anything listed on the CVE page: http://support.novell.com/security/cve/CVE-2013-6462.html
Comment 43 Marcus Meissner 2014-06-17 18:01:30 UTC
Currently unknown. It enters QA currently, but it might take some weeks.
Comment 44 Swamp Workflow Management 2014-07-09 14:50:22 UTC
Update released for: xorg-x11-devel, xorg-x11-devel-32bit, xorg-x11-libs, xorg-x11-libs-32bit, xorg-x11-libs-debuginfo, xorg-x11-libs-debuginfo-32bit, xorg-x11-libs-debuginfo-x86, xorg-x11-libs-debugsource, xorg-x11-libs-x86
Products:
SLE-DEBUGINFO 11-SP1 (i386, s390x, x86_64)
SLE-SERVER 11-SP1-LTSS (i386, s390x, x86_64)
Comment 45 Swamp Workflow Management 2014-07-09 18:04:57 UTC
SUSE-SU-2014:0881-1: An update that fixes 19 vulnerabilities is now available.

Category: security (moderate)
Bug References: 815451,821663,854915,857544
CVE References: CVE-2013-1984,CVE-2013-1985,CVE-2013-1986,CVE-2013-1988,CVE-2013-1990,CVE-2013-1991,CVE-2013-1992,CVE-2013-1995,CVE-2013-1996,CVE-2013-1998,CVE-2013-1999,CVE-2013-2000,CVE-2013-2001,CVE-2013-2003,CVE-2013-2063,CVE-2013-6462,CVE-2014-0209,CVE-2014-0210,CVE-2014-0211
Sources used:
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    xorg-x11-libs-7.4-8.26.42.4