{"vuid":"VU#147252","idnumber":"147252","name":"NVIDIA Display Driver for Unix systems vulnerable to buffer overflow","keywords":["NVIDIA","Binary Graphics Driver","Linux","buffer overflow","short sequence","glyphs"],"overview":"A vulnerability in the NVIDIA Display Driver for Unix systems may allow a remote attacker to execute code on a vulnerable system.","clean_desc":"The NVIDIA Display Driver for Unix systems provides access to the display adapter's accelerated features on supported systems, and includes a module for use with the X windowing system. Some versions of the driver contain a buffer overflow vulnerability in handling the size specification of text character data known as glyphs. An attacker with the ability to supply a specially crafted sequence of glyphs could exploit this vulnerability. Such an exploit could be supplied remotely via a malicious remote X client or an existing X client program, such as a web browser or email client. We are aware of publicly available exploit code for this vulnerability.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system or cause that system's X server to crash. The attacker-supplied code would be executed with the privileges of the X server, typically root.","resolution":"We are unaware of a practical solution to this problem.","workarounds":"Workarounds Use the nv driver\nDisable the NVIDIA-supplied driver in favor of the \"nv\" driver that is included by default with many X distributions. Note that implementing this workaround will result in loss of performance and features, since the nv driver does not provide access to the accelerated 3D features of the video adapter. Upgrade to the latest beta version of the driver\nThe latest beta version of the driver for Unix systems (Version: 1.0-9625) does not appear to contain this vulnerability. More information can be found on the NVIDIA BETA Drivers download page. Users may wish to upgrade to this version until an official release can be obtained from the vendor.","sysaffected":"","thanks":"This issue was discovered by \nDerek Abdine\n of \nRapid7, LLC\n and reported in \nRapid7 Advisory R7-0025\n. Rapid7 also credits \nMarc Bevand\n with assistance.","author":"This document was written by Chad R Dougherty.","public":["http://www.rapid7.com/advisories/R7-0025.jsp","http://secunia.com/advisories/22419/","http://securitydot.org/xpl/exploits/vulnerabilities/articles/1714/exploit.html"],"cveids":["CVE-2006-5379"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-10-17T12:43:20Z","publicdate":"2006-10-16T00:00:00Z","datefirstpublished":"2006-10-17T20:36:29Z","dateupdated":"2006-11-17T17:47:51Z","revision":20,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"10","cam_impact":"19","cam_easeofexploitation":"10","cam_attackeraccessrequired":"15","cam_scorecurrent":"12.290625","cam_scorecurrentwidelyknown":"12.290625","cam_scorecurrentwidelyknownexploited":"22.978125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":12.290625,"vulnote":null}