Re: Do you trust X server?

On Fri, 18 Mar 2005 09:35:12 +0100, Tom said:
> On Fri, Mar 18, 2005 at 12:26:04AM -0500, Valdis.Kletnieks@vt.edu wrote:
> > For a remote exploit of the X server itself, you'd have to find a way to
> > exploit the X protocol,
>
> Not true.
>
> This was 2002, and it was a DoS, but it shows that the X server can be
> attacked through remote applications:
>
> http://web.lemuria.org/security/mozilla-dos.html
>
> The short: A font-rendering bug in X can cause a system freeze if mozilla
> is instructed to render a huge (like 1666666 pixels) font.

Which is what I said - you'd have to find a bug that you can exploit through the client. And as I *also* said, even if you *found* such a bug, it would *probably* result in a crash of either the browser or X.

And how many issues have there been with Mozilla and Firefox since 2002?

I'd worry more about those...

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: stored