 |
|
 |
CERT® Advisory CA-2002-26 Buffer Overflow in CDE ToolTalkOriginal release date: August 12, 2002Last revised: September 9, 2002 Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected
OverviewThe Common Desktop Environment (CDE) ToolTalk RPC database server contains a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code or cause a denial of service. I. DescriptionThe Common Desktop Environment (CDE) is an integrated graphical user interface that runs on UNIX and Linux operating systems. CDE ToolTalk is a message brokering system that provides an architecture for applications to communicate with each other across hosts and platforms. The ToolTalk RPC database server, rpc.ttdbserverd, manages communication between ToolTalk applications. For more information about CDE, see http://www.opengroup.org/cde/ The CDE ToolTalk database server is vulnerable to a heap buffer overflow via an argument passed to the procedure _TT_CREATE_FILE(). An attacker with access to the ToolTalk RPC database service could exploit this vulnerability with a specially crafted RPC message. Vulnerability Note VU#387387 includes a list of vendors who have been contacted about this vulnerability. This vulnerability was discovered and reported by the Entercept Ricochet Team and is described in the following Entercept Security Alert: http://www.entercept.com/news/uspr/08-12-02.asp This vulnerability has been assigned CAN-2002-0679 by the Common Vulnerabilities and Exposures (CVE) group. A list previously documented problems in CDE can be found in Appendix B. II. ImpactUsing an RPC message containing a specially crafted argument to _TT_CREATE_FILE(), a remote attacker could execute arbitrary code or cause a denial of service. The ToolTalk database server process runs with root privileges on most systems. Note that the non-executable stack protection provided by some operating systems will not prevent the execution of code located on the heap. III. SolutionApply a patch from your vendorAppendix A contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Please contact your vendor directly. Disable vulnerable serviceUntil patches are available and can be applied, you may wish to disable the ToolTalk RPC database service. As a best practice, the CERT/CC recommends disabling all services that are not explicitly required. On a typical CDE system, it should be possible to disable rpc.ttdbserverd by commenting out the relevant entries in /etc/inetd.conf and if necessary, /etc/rpc, and then by restarting the inetd process. The program number for the ToolTalk RPC database server is 100083. If references to 100083 or rpc.ttdbserverd appear in /etc/inetd.conf or /etc/rpc or in output from the rpcinfo(1M) and ps(1) commands, then the ToolTalk RPC database server may be running. The following example was taken from a system running SunOS 5.8 (Solaris 8):
/etc/inetd.conf
...
#
# Sun ToolTalk Database Server
#
100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
...
# rpcinfo -p
program vers proto port service
...
100083 1 tcp 32773
...
# ps -ef
UID PID PPID C STIME TTY TIME CMD
...
root 355 164 0 19:31:27 ? 0:00 rpc.ttdbserverd
...
Before deciding to disable the ToolTalk RPC database server or the RPC portmapper service, carefully consider your network configuration and service requirements. Block access to vulnerable serviceUntil patches are available and can be applied, you may wish to block access to the ToolTalk RPC database server and possibly the RPC portmapper service from untrusted networks such as the Internet. Use a firewall or other packet-filtering technology to block the appropriate network ports. The ToolTalk RPC database server may be configured to use port 692/tcp or another port as indicated in output from the rpcinfo(1M) command. In the example above, the ToolTalk RPC database server is configured to use port 32773/tcp. The RPC portmapper service typically runs on ports 111/tcp and 111/udp. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from attacks that originate from the internal network. Before deciding to block or restrict access to the ToolTalk RPC database server or the RPC portmapper service, carefully consider your network configuration and service requirements. Appendix A. - Vendor InformationThis appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Caldera, Inc.
Cray, Inc.
Hewlett-Packard Company
IBM Corporation
SGI
Sun Microsystems, Inc.
Xi Graphics
Appendix B. - References
The CERT Coordination Center thanks Sinan Eren of the Entercept Richochet Team for reporting this vulnerability. Author: Art Manion This document is available from: http://www.cert.org/advisories/CA-2002-26.html CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryptionWe strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from If you prefer to use DES, please call the CERT hotline for more information. Getting security informationCERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
NO WARRANTY Conditions for use, disclaimers, and sponsorship information
Copyright 2002 Carnegie Mellon University. Revision History
August 12, 2002: Initial release |
