PT-2011-5211 · X.Org+2 · Xorg-X11+2
Matthieu Herrb
+1
·
Published
1970-01-01
·
Updated
2017-08-17
·
CVE-2011-0465
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
XFree86 versions prior to 1.0.9
xorg-x11 versions prior to 7.4
Description
The vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP or XDMCP message. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of the vulnerability can be carried out remotely.
Recommendations
For XFree86 versions prior to 1.0.9, update to version 1.0.9 or later.
For xorg-x11 versions prior to 7.4, update to version 7.4 or later.
As a temporary workaround, consider disabling the
xrdb.c function in XFree86 until a patch is available.
Restrict access to the vulnerable xorg-x11 module to minimize the risk of exploitation.
Avoid using the hostname parameter in the affected API endpoint until the issue is resolved.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Xfree86
Xorg-X11