https://www.exploit-db.com/exploits/20294
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-173

XFree3.3.x版本中的xlib存在缓冲区溢出漏洞。本地用户可能借助超长DISPLAY环境变量或-display命令行参数执行任意命令。

source: http://www.securityfocus.com/bid/1805/info

A vulnerability exists in xlib, the C language interface to the X Window System protocol. 

When applications linked to the xlib library are run, user-supplied values for the DISPLAY environment variable (and the command-line argument -display) are stored in buffers of predefined length. It is not verified that the amount data is within the predefined size limits before it is copied onto the stack during function calls. 

Consequently it is possible for users to overwrite stack variables such as the calling function's return address with arbitrary values that can alter the program's flow of execution. 

While this vulnerability permits only numeric characters to be written to the stack, a successful exploit of this vulnerability can lead to partial overwriting of addresses and local variables.

cwsys$ DISPLAY=:`perl -e '{print "0"x128}'` xterm
Segmentation fault
cwsys$

来源:BID
名称:1805
链接:http://www.securityfocus.com/bid/1805
来源:BUGTRAQ
名称:20001012anotherXlibbufferoverflow
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0211.html
来源:XF
名称:xfree-xlib-bo(5751)
链接:http://www.iss.net/security_center/static/5751.php
来源:SGI
名称:20020502-01-I
链接:ftp://patches.sgi.com/support/free/security/advisories/20020502-01-I