Vulnerabilities > CVE-2018-14600 - Out-of-bounds Write vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2020-1433.
#

include("compat.inc");

if (description)
{
  script_id(137090);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/09");

  script_cve_id("CVE-2018-14598", "CVE-2018-14599", "CVE-2018-14600", "CVE-2018-15853", "CVE-2018-15854", "CVE-2018-15855", "CVE-2018-15856", "CVE-2018-15857", "CVE-2018-15859", "CVE-2018-15861", "CVE-2018-15862", "CVE-2018-15863", "CVE-2018-15864");
  script_xref(name:"ALAS", value:"2020-1433");

  script_name(english:"Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote Amazon Linux 2 host is missing a security update."
  );
  script_set_attribute(
    attribute:"description",
    value:
"It was discovered that libX11 does not properly validate input coming
from the server, causing XListExtensions() and XGetFontPath()
functions to produce an invalid list of elements that in turn make
XFreeExtensionsList() and XFreeFontPath() access invalid memory. An
attacker who can either configure a malicious X server or modify the
data coming from one, could use this flaw to crash the application
using libX11, resulting in a denial of service.(CVE-2018-14598)

An off-by-one error has been discovered in libX11 in functions
XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who
can either configure a malicious X server or modify the data coming
from one could use this flaw to make the program crash or have other
unspecified effects, caused by the memory corruption.(CVE-2018-14599)

An out of bounds write, limited to NULL bytes, was discovered in
libX11 in functions XListExtensions() and XGetFontPath(). The length
field is considered as a signed value, which makes the library access
memory before the intended buffer. An attacker who can either
configure a malicious X server or modify the data coming from one
could use this flaw to make the program crash or have other
unspecified effects, caused by the memory corruption.(CVE-2018-14600)

An uncontrolled recursion flaw was found in libxkbcommon in the way it
parses boolean expressions. A specially crafted file provided to
xkbcomp could crash the application. (CVE-2018-15853)

Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used
by local attackers to crash (NULL pointer dereference) the xkbcommon
parser by supplying a crafted keymap file, because geometry tokens
were desupported incorrectly. (CVE-2018-15854)

Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used
by local attackers to crash (NULL pointer dereference) the xkbcommon
parser by supplying a crafted keymap file, because the XkbFile for an
xkb_geometry section was mishandled. (CVE-2018-15855)

An infinite loop when reaching EOL unexpectedly in compose/parser.c
(aka the keymap parser) in xkbcommon before 0.8.1 could be used by
local attackers to cause a denial of service during parsing of crafted
keymap files. (CVE-2018-15856)

An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in
xkbcommon before 0.8.1 could be used by local attackers to crash
xkbcommon keymap parsers or possibly have unspecified other impact by
supplying a crafted keymap file. (CVE-2018-15857)

Unchecked NULL pointer usage when parsing invalid atoms in
ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be
used by local attackers to crash (NULL pointer dereference) the
xkbcommon parser by supplying a crafted keymap file, because lookup
failures are mishandled. (CVE-2018-15859)

Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in
xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
pointer dereference) the xkbcommon parser by supplying a crafted
keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861)

Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in
xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
pointer dereference) the xkbcommon parser by supplying a crafted
keymap file with invalid virtual modifiers. (CVE-2018-15862)

Unchecked NULL pointer usage in ResolveStateAndPredicate in
xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local
attackers to crash (NULL pointer dereference) the xkbcommon parser by
supplying a crafted keymap file with a no-op modmask expression.
(CVE-2018-15863)

Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in
xkbcommon before 0.8.2 could be used by local attackers to crash (NULL
pointer dereference) the xkbcommon parser by supplying a crafted
keymap file, because a map access attempt can occur for a map that was
never created. (CVE-2018-15864)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/AL2/ALAS-2020-1433.html"
  );
  script_set_attribute(
    attribute:"solution",
    value:"Run 'yum update xorg-x11-server' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xdmx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xephyr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xnest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xorg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xvfb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-Xwayland");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xorg-x11-server-source");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/06/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/04");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xdmx-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xephyr-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xnest-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xorg-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xvfb-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-Xwayland-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-common-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-debuginfo-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-devel-1.20.4-7.amzn2.0.1")) flag++;
if (rpm_check(release:"AL2", reference:"xorg-x11-server-source-1.20.4-7.amzn2.0.1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xorg-x11-server-Xdmx / xorg-x11-server-Xephyr / etc");
}

#
# (C) Tenable Network Security, Inc.
#

# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2019-0242. The text
# itself is copyright (C) ZTE, Inc.

include('compat.inc');

if (description)
{
  script_id(132459);
  script_version("1.2");
  script_cvs_date("Date: 2020/01/02");

  script_cve_id("CVE-2018-14598", "CVE-2018-14599", "CVE-2018-14600");
  script_bugtraq_id(105177);

  script_name(english:"NewStart CGSL CORE 5.05 / MAIN 5.05 : libX11 Multiple Vulnerabilities (NS-SA-2019-0242)");

  script_set_attribute(attribute:"synopsis", value:
"The remote machine is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libX11 packages installed that are affected by
multiple vulnerabilities:

  - An issue was discovered in XListExtensions in ListExt.c
    in libX11 through 1.6.5. A malicious server can send a
    reply in which the first string overflows, causing a
    variable to be set to NULL that will be freed later on,
    leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The
    function XListExtensions in ListExt.c interprets a
    variable as signed instead of unsigned, resulting in an
    out-of-bounds write (of up to 128 bytes), leading to DoS
    or remote code execution. (CVE-2018-14600)

  - An issue was discovered in libX11 through 1.6.5. The
    function XListExtensions in ListExt.c is vulnerable to
    an off-by-one error caused by malicious server
    responses, leading to DoS or possibly unspecified other
    impact. (CVE-2018-14599)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0242");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL libX11 packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-14600");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/12/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/ZTE-CGSL/release");
if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");

if (release !~ "CGSL CORE 5.05" &&
    release !~ "CGSL MAIN 5.05")
  audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');

if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);

flag = 0;

pkgs = {
  "CGSL CORE 5.05": [
    "libX11-1.6.7-2.el7",
    "libX11-common-1.6.7-2.el7",
    "libX11-debuginfo-1.6.7-2.el7",
    "libX11-devel-1.6.7-2.el7"
  ],
  "CGSL MAIN 5.05": [
    "libX11-1.6.7-2.el7",
    "libX11-common-1.6.7-2.el7",
    "libX11-debuginfo-1.6.7-2.el7",
    "libX11-devel-1.6.7-2.el7"
  ]
};
pkg_list = pkgs[release];

foreach (pkg in pkg_list)
  if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libX11");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201811-01.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(118845);
  script_version("1.1");
  script_cvs_date("Date: 2018/11/09 10:00:39");

  script_cve_id("CVE-2018-14598", "CVE-2018-14599", "CVE-2018-14600");
  script_xref(name:"GLSA", value:"201811-01");

  script_name(english:"GLSA-201811-01 : X.Org X11 library: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201811-01
(X.Org X11 library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X11 library.
      Please review the CVE identifiers referenced below for details.
  
Impact :

    A remote attacker, by enticing a user to connect to a malicious server,
      could cause the execution of arbitrary code with the privileges of the
      process, or cause a Denial of Service condition.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201811-01"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All X.Org X11 library users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=x11-libs/libX11-1.6.6'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libX11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2018/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/09");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"x11-libs/libX11", unaffected:make_list("ge 1.6.6"), vulnerable:make_list("lt 1.6.6"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "X.Org X11 library");
}