'Critical' security bugs dating back to 1987 found in X Window

X.org, which develops the open-source X Window System for Linux and other Unix-y desktops, has warned security flaws have been discovered in the code – and some of them have been hanging around for 27 years.

The bugs can be exploited by applications to crash the window system, or run malicious code as the root user if the X server is running with those privileges (not every operating system runs the display server as root).

The programming blunders were discovered by Ilja van Sprundel, a security researcher at IOActive, and cover how the X Server handles requests from client apps. IOActive has worked with X.org to patch the ancient problems, and users are urged to get patching.

Fixes should appear in xorg-server-1.17.0 and xorg-server-1.16.3; there are workarounds one can apply in the meantime. Some of the bugs involve things like not checking a pointer for NULL before passing it to memmove().

"The vulnerabilities could be exploited to cause the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution," the group said.

"How critical these vulnerabilities are to any given installation depends on whether they run an X server with root privileges or reduced privileges; whether they run X servers exposed to network clients or limited to local connections; and whether or not they allow use of the affected protocol extensions, especially the GLX extension."

The GLX extensions are used when a program asks the X Server to perform some OpenGL rendering, and the researcher says the same flaw could be a problem in various Unix-flavored distributions. The original code was contributed by SGI and later made open source in 1999.

Other problems include the ability to crash X Servers using SUN-DES-1 (Secure RPC) authentication credentials via unduly large malloc requests. The flaw stems from code introduced in 1991, but the oldest vulnerability – flaws in X11 core protocol requests – stems back to 1987. ®