Issued:
2011-04-11
Updated:
2011-04-11

RHSA-2011:0433 - Security Advisory

Synopsis

Moderate: xorg-x11-server-utils security update

Type/Severity

Security Advisory: Moderate

Topic

An updated xorg-x11-server-utils package that fixes one security issue is
now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The xorg-x11-server-utils package contains a collection of utilities used
to modify and query the runtime configuration of the X.Org server. X.Org is
an open source implementation of the X Window System.

A flaw was found in the X.Org X server resource database utility, xrdb.
Certain variables were not properly sanitized during the launch of a user's
graphical session, which could possibly allow a remote attacker to execute
arbitrary code with root privileges, if they were able to make the display
manager execute xrdb with a specially-crafted X client hostname. For
example, by configuring the hostname on the target system via a crafted
DHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to
connect to that system from a host that has a special DNS name.
(CVE-2011-0465)

Red Hat would like to thank Matthieu Herrb for reporting this issue.
Upstream acknowledges Sebastian Krahmer of the SuSE Security Team as the
original reporter.

Users of xorg-x11-server-utils should upgrade to this updated package,
which contains a backported patch to resolve this issue. All running X.Org
server instances must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
  • Red Hat Enterprise Linux Server - AUS 5.6 ia64
  • Red Hat Enterprise Linux Server - AUS 5.6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 6 s390x
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64
  • Red Hat Enterprise Linux Server from RHUI 6 x86_64
  • Red Hat Enterprise Linux Server from RHUI 6 i386
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386
  • Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
  • Red Hat Enterprise Linux Server - AUS 5.6 x86_64

Fixes

  • BZ - 680196 - CVE-2011-0465 xorg: xrdb code execution via crafted X client hostname

CVEs

References

Red Hat Enterprise Linux Server 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
x86_64
xorg-x11-server-utils-7.4-15.el6_0.1.x86_64.rpm SHA-256: 28eb4c5cce90a047302f40968462cd4092d3caa2774a998307d98fcced1e8cb3
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.x86_64.rpm SHA-256: 962b60a2d8843d04f8e214381e523d7b27a612945fb0e41c6a27cd640ba51adc
i386
xorg-x11-server-utils-7.4-15.el6_0.1.i686.rpm SHA-256: ec9ef74152f5910b070e2b1eab65e92724abeefef0c13a0d8f44c3eff9400100
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.i686.rpm SHA-256: 6856ada7d525dbbd593f885818863e855a7a636c9d9528a805a609db47b9ee17

Red Hat Enterprise Linux Server 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
ia64
xorg-x11-server-utils-7.1-5.el5_6.1.ia64.rpm SHA-256: b07323c55f01c46ccb0838fb53bf3e4d0eeeac4ad88f45d050060ee12e2a4a5e
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
ia64
xorg-x11-server-utils-7.1-5.el5_6.1.ia64.rpm SHA-256: b07323c55f01c46ccb0838fb53bf3e4d0eeeac4ad88f45d050060ee12e2a4a5e
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

Red Hat Enterprise Linux Server from RHUI 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
ia64
xorg-x11-server-utils-7.1-5.el5_6.1.ia64.rpm SHA-256: b07323c55f01c46ccb0838fb53bf3e4d0eeeac4ad88f45d050060ee12e2a4a5e
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

Red Hat Enterprise Linux Workstation 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
x86_64
xorg-x11-server-utils-7.4-15.el6_0.1.x86_64.rpm SHA-256: 28eb4c5cce90a047302f40968462cd4092d3caa2774a998307d98fcced1e8cb3
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.x86_64.rpm SHA-256: 962b60a2d8843d04f8e214381e523d7b27a612945fb0e41c6a27cd640ba51adc
i386
xorg-x11-server-utils-7.4-15.el6_0.1.i686.rpm SHA-256: ec9ef74152f5910b070e2b1eab65e92724abeefef0c13a0d8f44c3eff9400100
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.i686.rpm SHA-256: 6856ada7d525dbbd593f885818863e855a7a636c9d9528a805a609db47b9ee17

Red Hat Enterprise Linux Workstation 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

Red Hat Enterprise Linux Desktop 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
x86_64
xorg-x11-server-utils-7.4-15.el6_0.1.x86_64.rpm SHA-256: 28eb4c5cce90a047302f40968462cd4092d3caa2774a998307d98fcced1e8cb3
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.x86_64.rpm SHA-256: 962b60a2d8843d04f8e214381e523d7b27a612945fb0e41c6a27cd640ba51adc
i386
xorg-x11-server-utils-7.4-15.el6_0.1.i686.rpm SHA-256: ec9ef74152f5910b070e2b1eab65e92724abeefef0c13a0d8f44c3eff9400100
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.i686.rpm SHA-256: 6856ada7d525dbbd593f885818863e855a7a636c9d9528a805a609db47b9ee17

Red Hat Enterprise Linux Desktop 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
s390x
xorg-x11-server-utils-7.4-15.el6_0.1.s390x.rpm SHA-256: 30b9e79c13d31b9270fee6038db79525101dc1cefd54f03f5474a06e2026f20f
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.s390x.rpm SHA-256: 55a9edb73b7bab0ef99d6fde407596aaf5b34612a238a993cd2491add64ce8e4

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
s390x
xorg-x11-server-utils-7.1-5.el5_6.1.s390x.rpm SHA-256: 90db2055058c2b39e3404a5c2b26fc5864b4451e76c19d2140aa30fa3f138a46

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
s390x
xorg-x11-server-utils-7.1-5.el5_6.1.s390x.rpm SHA-256: 90db2055058c2b39e3404a5c2b26fc5864b4451e76c19d2140aa30fa3f138a46

Red Hat Enterprise Linux for Power, big endian 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
ppc64
xorg-x11-server-utils-7.4-15.el6_0.1.ppc64.rpm SHA-256: 243439c42abf79ec9bfb6c836cc97bc614cdbd36b428cfa49d7d97aab9e9b442
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.ppc64.rpm SHA-256: a30d8f5cc3ce548f7f942ae200786f7db36dcb2cf939c2a624c9ebf7f98c9ce7

Red Hat Enterprise Linux for Power, big endian 5

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
ppc
xorg-x11-server-utils-7.1-5.el5_6.1.ppc.rpm SHA-256: d50f331e2c333a7cf91f64c64adc18839e1a2da527ddb9fb521bef9db9a6e40d

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
ppc
xorg-x11-server-utils-7.1-5.el5_6.1.ppc.rpm SHA-256: d50f331e2c333a7cf91f64c64adc18839e1a2da527ddb9fb521bef9db9a6e40d

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
x86_64
xorg-x11-server-utils-7.4-15.el6_0.1.x86_64.rpm SHA-256: 28eb4c5cce90a047302f40968462cd4092d3caa2774a998307d98fcced1e8cb3
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.x86_64.rpm SHA-256: 962b60a2d8843d04f8e214381e523d7b27a612945fb0e41c6a27cd640ba51adc

Red Hat Enterprise Linux Server from RHUI 6

SRPM
xorg-x11-server-utils-7.4-15.el6_0.1.src.rpm SHA-256: 1ccc0e8f577d781bc785bcf6ac16b0148a58d9c2863875f881bbd6c1aa9fdf5a
x86_64
xorg-x11-server-utils-7.4-15.el6_0.1.x86_64.rpm SHA-256: 28eb4c5cce90a047302f40968462cd4092d3caa2774a998307d98fcced1e8cb3
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.x86_64.rpm SHA-256: 962b60a2d8843d04f8e214381e523d7b27a612945fb0e41c6a27cd640ba51adc
i386
xorg-x11-server-utils-7.4-15.el6_0.1.i686.rpm SHA-256: ec9ef74152f5910b070e2b1eab65e92724abeefef0c13a0d8f44c3eff9400100
xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1.i686.rpm SHA-256: 6856ada7d525dbbd593f885818863e855a7a636c9d9528a805a609db47b9ee17

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
xorg-x11-server-utils-7.1-5.el5_6.1.src.rpm SHA-256: 130f83e1194b2593a9cf154bf3d84d66b5b0c8767cf481e23002879cee2daf0b
x86_64
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64.rpm SHA-256: a24d17bb7fb70a91a37239c9a49363e95f07da06d1f51134ddaa3a238d17e4d2
i386
xorg-x11-server-utils-7.1-5.el5_6.1.i386.rpm SHA-256: f00c0aa9e8264eb0a1f56783887bb0d110ce181010296a5d4185ae14a8a42f5e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.