libx11 API Protocol Command Injection

[Unparalleled IT Security Research <info () unparalleled eu>]

Hello list,

Due to missing request length checks in libX11 injection of X
protocol commands is possible, e.g. by using long color names
in color lookup API calls. The color names in some cases may
be (remotely) attacker controlled, e.g. when xterm receives OCS
(operating system command sequences) from an SSH session to
a compromised server or a careless "tail -f" on a log file containing
OCS. A crafted OCS color name can be used to disable X server
authentication, mess up the keyboard layout, ...

Luckily only very few data flow pathes were found to trigger
such bogus color lookup calls. Color specifications in PDF, HTML,
SVG, ... were not suitable to reach the API in a problematic way
for those applications tested.

See the attached UNPAR-2021-1 advisory or the blog entry describing
how exploitation works in detail:

https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/


Kind regards,

| |  DI Roman Fiedler
| /  roman.fiedler at unparalleled.eu  +43 677 63 29 28 29
/ |  Unparalleled IT Services e.U.     FN: 516074h           VAT: ATU75050524
| |  https://unparalleled.eu/          Felix-Dahn-Platz 4, 8010 Graz, Austria

Attachment: advisory-unpar-2021-1.txt
Description: advisory-unpar-2021-1.txt