GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Tue Nov 07, 2006 11:26 pm Post subject: [ GLSA 200611-03 ] NVIDIA binary graphics driver: Privilege |
|
|
Gentoo Linux Security Advisory
Title: NVIDIA binary graphics driver: Privilege escalation vulnerability (GLSA 200611-03)
Severity: high
Exploitable: remote, local
Date: November 07, 2006
Updated: November 10, 2006
Bug(s): #151635
ID: 200611-03
Synopsis
The NVIDIA binary graphics driver is vulnerable to a local privilege escalation through an X session.
Background
The NVIDIA binary graphics driver from NVIDIA Corporation provides the kernel module and the GL modules for graphic acceleration on the NVIDIA based graphic cards.
Affected Packages
Package: x11-drivers/nvidia-drivers
Vulnerable: < 1.0.8776
Unaffected: >= 1.0.8776
Unaffected: < 1.0.8762
Architectures: All supported architectures
Description
Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the accelerated rendering functionality.
Impact
An X client could trigger the buffer overflow with a maliciously crafted series of glyphs. A remote attacker could also entice a user to open a specially crafted web page, document or X client that will trigger the buffer overflow. This could result in the execution of arbitrary code with root privileges or at least in the crash of the X server.
Workaround
Disable the accelerated rendering functionality in the Device section of xorg.conf : Code: | Option "RenderAccel""false" |
Resolution
NVIDIA binary graphics driver users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-1.0.8776" |
References
CVE-2006-5379
Last edited by GLSA on Wed Nov 07, 2007 4:18 am; edited 3 times in total |
|