PT-2011-5211 · X.Org+2 · Xorg-X11+2
Matthieu Herrb
+1
·
Publicado
1970-01-01
·
Atualizado
2017-08-17
·
CVE-2011-0465
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
XFree86 versions prior to 1.0.9
xorg-x11 versions prior to 7.4
Description
The vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP or XDMCP message. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of the vulnerability can be carried out remotely.
Recommendations
For XFree86 versions prior to 1.0.9, update to version 1.0.9 or later.
For xorg-x11 versions prior to 7.4, update to version 7.4 or later.
As a temporary workaround, consider disabling the
xrdb.c function in XFree86 until a patch is available.
Restrict access to the vulnerable xorg-x11 module to minimize the risk of exploitation.
Avoid using the hostname parameter in the affected API endpoint until the issue is resolved.Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Xfree86
Xorg-X11