CERTVU:975403Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file descriptor arguement to _TT_ISCLOSE()
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
81.6%
Overview
The Common Desktop Environment (CDE) ToolTalk RPC database server does not adequately validate a client-supplied argument, allowing attackers to overwrite certain locations in memory with zeros. This vulnerability could be exploited in a number of ways, potentially allowing attackers to: cause a denial of service, remotely delete arbitrary files, remotely create arbitrary directories, and potentially execute arbitrary code or commands.
Description
CORE SECURITY TECHNOLOGIES has reported a vulnerability in the CDE ToolTalk RPC database server (rpc.ttdbserverd). A component of CDE, the ToolTalk architecture allows applications to communicate with each other via remote procedure calls (RPC) across different hosts and platforms. The ToolTalk RPC database server manages connections between ToolTalk applications. CDE and ToolTalk are installed and enabled by default on many common UNIX platforms.
ToolTalk clients can close a ToolTalk database by issuing an RPC request to the database server. During this process, a call is made to the procedure _TT_ISCLOSE(), and a file descriptor argument supplied by the client is used to reference a memory structure that contains information about the requested ToolTalk database. A memory location within the structure is set to zero (0L), ostensibly closing the requested database. The ToolTalk database server does not check the range of the file descriptor, so it is possible to reference a location in memory that is outside the region that contains valid database information. As a result, a specially crafted RPC call can cause specific memory locations in the ToolTalk database server process space to be set to zero. By issuing such a call, and also by controlling the contents of memory through other means, attackers could exploit this vulnerability in a number of different ways.
Impact
The CORE SECURITY TECHNOLOGIES report describes several different attacks including remotely deleting arbitrary files and remotely creating arbitrary directory entries. In addition, attackers might be able to crash the ToolTalk RPC database server, denying service to legitimate users. It could be possible for attackers to execute arbitrary code and commands, although this has not yet been demonstrated. The ToolTalk RPC database server typically runs with root privileges.
Solution
Apply a Patch
When available, apply a patch from your vendor.
Disable rpc.ttdbserverd
Until patches are available and can be applied, you may wish to consider disabling the ToolTalk RPC database service. As a general best practice, the CERT/CC recommends disabling any services that are not explicitly required. The ToolTalk RPC database service may be enabled in /etc/rpc or in /etc/inetd.conf. On a Solaris 8 system, comment out the following entry in /etc/inetd.conf to disable the ToolTalk RPC database service (rpc.ttdbserverd):
#
# Sun ToolTalk Database Server
#
100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
The rpcinfo(1M) and ps(1) commands may be useful in determining if you system is running the ToolTalk RPC database server. On a Solaris 8 system, the following examples indicate that the ToolTalk RPC database server is running:
# rpcinfo -p | grep 100083
100083 1 tcp 32773
# ps -ef | grep rpc.ttdbserverd
root 355 164 0 19:31:27 ? 0:00 rpc.ttdbserverd
Block or Restrict Access
Until patches are available and can be applied, block or restrict access to the RPC portmapper service and the ToolTalk RPC database service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block the ports used by the RPC portmapper and ToolTalk RPC services. The RPC portmapper service typically runs on ports 111/tcp and 111/udp. The ToolTalk RPC service may be configured to use port 692/tcp or another port as indicated in output from the rpcinfo command. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network. It is important to understand your network configuration and service requirements before deciding what changes are appropriate.
Vendor Information
975403
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Compaq Computer Corporation __ Affected
Notified: June 11, 2002 Updated: September 09, 2002
Status
Affected
Vendor Statement
SOURCE: Compaq Computer Corporation, a wholly-owned subsidiary of Hewlett-Packard Company and Hewlett-Packard Company HP Services Software Security Response Team
CROSS REFERENCE: SSRT2251
At this time Compaq does have solutions in final testing and will publish HP Tru64 UNIX security bulletin (SSRT2251) with patch information as soon as testing has completed and kits are available from the support ftp web site.
A recommended workaround however is to disable rpc.ttdbserver until solutions are available. This should only create a potential problem for public software packages applications that use the RPC-based ToolTalk database server. This step should be evaluated against the risks identified, your security measures environment, and potential impact of other products that may use the ToolTalk database server.
To disable rpc.ttdbserverd:
* Comment out the following line in /etc/inetd.conf:
rpc.ttdbserverd stream tcp swait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
* Force inetd to re-read the configuration file by executing the inetd -h command.
Note: The internet daemon should kill the currently running rpc.ttdbserver. If not, manually kill any existing rpc.ttdbserverd process.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Compaq (Hewlett-Packard) has released a security bulletin (SRB0039W/SSRT2251) that addresses VU#975403 and other vulnerabilities.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Hewlett-Packard Company __ Affected
Notified: June 11, 2002 Updated: August 15, 2002
Status
Affected
Vendor Statement
` -----------------------------------------------------------------
REVISED 02
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0207-199
Originally issued: 12 July 2002
Last revision: 14 Aug 2002
SSRT2274 Sec. Vulnerability in rpc.ttdbserver
`
The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
------------------------------------------------------------------ PROBLEM: Buffer overflow in rpc.ttdbserver
PLATFORM: HP9000 Series 700/800 running HP-UX releases 10.10, 10.20, 10.24, 11.00, 11.04, and 11.11.
DAMAGE: Potential unauthorized access, increased privileges.
SOLUTION: Until patches are available, manually install a replacement rpc.ttdbserver.
MANUAL ACTIONS: Install replacement rpc.ttdbserver.
AVAILABILITY: The replacement rpc.ttdbserver files are available now.
CHANGE SUMMARY: Added CA-2002-26 information
------------------------------------------------------------------ **REVISED 02** A. Background -->>Buffer overflows in rpc.ttdbserver has been reported by CERT -->>in CA-2002-20 and CA-2002-26. The potential exists to exploit -->>these overflows to gain unauthorized access.
B. Recommended solution Until patches are available, install the appropriate file to replace rpc.ttdbserver.
Note: The 10.20 file should be used for 10.24. The 11.00 file should be used for 11.04.
On 10.24 and 11.04 (VVOS) rpc.ttdbserver is disabled by default.
**REVISED 02** -->> 1. Download rpc.ttdbserver.2.tar.gz from the ftp site. This file is temporary and will be deleted when patches are available from the standard HP web sites, including itrc.hp.com.
System: hprc.external.hp.com (192.170.19.51) Login: ttdb1 Password: ttdb1
FTP Access: ``<ftp://ttdb1:[email protected]/>`` or: ``<ftp://ttdb1:[email protected]/>``
-->> file: rpc.ttdbserver.2.tar.gz
` Note: There is an ftp defect in IE5 that may result in
a browser hang. To work around this:
- Select Tools -> Internet Options -> Advanced
- Un-check the option: [ ] Enable folder view for FTP sites
–>> 2. Copy the rpc.ttdbserver.2.tar.gz file to a protected
directory and unpack it.
If you wish to verify the md5 sum before unpacking the
rpc.ttdbserver.tar.gz file, please refer to:
Patch sums and the MD5 program
–>> e6af458213a9834146f716c9df7f1aaf
install_rpc.ttdbserver script or some similar procedure.
The install_rpc.ttdbserver script is included in
–>> rpc.ttdbserver.2.tar.gz.
###################################################
–>>rpc.ttdbserver.1010:
–>> X Window System, Version 11 R5+ HP-UX B.10.10.020810 -O
–>> (build date: Sat Aug 10 13:35:19 IST 2002)
–>> rpc.ttdbserver: $Revision: 1.1 $
–>>2536143200 323584 rpc.ttdbserver.1010
###################################################
–>>$ what rpc.ttdbserver.1020
–>>rpc.ttdbserver.1020:
–>> X Window System, Version 11 R6+ HP-UX B.10.20.020810 +O2
–>> (build date: Sat Aug 10 12:56:54 IST 2002)
–>> rpc.ttdbserver: $Revision: 1.1 $
–>>1981972883 323584 rpc.ttdbserver.1020
###################################################
–>>$ what rpc.ttdbserver.1100
–>>rpc.ttdbserver.1100:
–>> View: /view/venu_main, Build Type: r6hp700_1100
–>> hpcde2.1
–>> (build date: Fri Aug 9 10:49:13 IST 2002)
–>> [rest deleted]
–>>3680305777 327680 rpc.ttdbserver.1100
###################################################
–>>$ what rpc.ttdbserver.1111
–>>rpc.ttdbserver.1111:
–>> View: /view/venu_main, Build Type: r6hp700_1111
–>> hpcde2.1
–>> (build date: Fri Aug 9 11:37:48 IST 2002)
–>> [rest deleted]
–>>595997811 352256 rpc.ttdbserver.1111
###################################################
`
C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP IT Resource Center via electronic mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
``<http://itrc.hp.com>``
Use the 'Login' tab at the left side of the screen to login using your ID and password. Use your existing login or the "Register" button at the left to create a login, in order to gain access to many areas of the ITRC. Remember to save the User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other Technical Digests, click the check box (in the left column) for the appropriate digest and then click the "Update Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link (in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select the link for "The Security Bulletins Archive". (near the bottom of the page) Once in the archive the third link is to the current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. Security Patch Check completely automates the process of reviewing the patch matrix for 11.XX systems.
For information on the Security Patch Check tool, see: ``<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/>`` displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous ftp:
``<ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/>``
On the "Support Information Digest Main" page: click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
[email protected]
Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to [email protected].
Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes.
` Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
-----End of Document ID: HPSBUX0207-199--------------------------------------`
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
IBM __ Affected
Notified: June 11, 2002 Updated: July 11, 2002
Status
Affected
Vendor Statement
The CDE desktop product shipped with AIX is vulnerable to both the issues detailed above in the advisory. This affects AIX releases 4.3.3 and 5.1.0. An efix package will be available shortly from the IBM software ftp site. The efix packages can be downloaded from ftp.software.ibm.com/aix/efixes/security. This directory contains a README file that gives further details on the efix packages.
The following APARs will be available in the near future:
AIX 4.3.3: IY32368
AIX 5.1.0: IY32370
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
SGI __ Affected
Notified: June 11, 2002 Updated: November 07, 2002
Status
Affected
Vendor Statement
SGI acknowledges the ToolTalk vulnerabilities reported by CERT and is currently investigating. No further information is available at this time.
For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements. As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list on <http://www.sgi.com/support/security/>.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Please refer to SGI Security Advisories 20021101-01-P (CDE ToolTalk) and 20021102-01-P (IRIX ToolTalk).
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Sun Microsystems Inc. __ Affected
Notified: June 11, 2002 Updated: July 10, 2002
Status
Affected
Vendor Statement
The Solaris RPC-based ToolTalk database server, rpc.ttdbserverd, is vulnerable to the two vulnerabilities [VU#975403 VU#299816] described in this advisory in all currently supported versions of Solaris:
Solaris 2.5.1, 2.6, 7, 8, and 9
Patches are being generated for all of the above releases. Sun will publish a Sun Security Bulletin and a Sun Alert for this issue. The Sun Alert will be available from:
<http://sunsolve.sun.com>
The patches will be available from:
<http://sunsolve.sun.com/securitypatch>
Sun Security Bulletins are available from:
<http://sunsolve.sun.com/security>
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
The SCO Group (SCO UnixWare) __ Affected
Notified: June 12, 2002 Updated: September 13, 2002
Status
Affected
Vendor Statement
Caldera Open UNIX and Caldera UnixWare provide the CDE ttdbserverd daemon, and are vulnerable to these issues. Please see Caldera Security Advisory CSSA-2002-SCO.28 for more information.
SCO OpenServer and Caldera OpenLinux do not provide CDE, and are therefore not vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
According to Caldera’s investigation, UnixWare 7.1.1 and Open UNIX 8.0.0 appear vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Xi Graphics __ Affected
Notified: June 12, 2002 Updated: June 13, 2002
Status
Affected
Vendor Statement
Xi Graphics deXtop CDE v2.1 is vulnerable to this attack. A update correcting this issue will be available on our ftp site once this vulnerability has been publically announced.
Most sites do not need to use the ToolTalk server daemon. Xi Graphics Security recommends that non-essential services are never enabled. To disable the ToolTalk server on your system, edit /etc/inetd.conf and comment out, or remove, the ‘rpc.ttdbserver’ line. Then, either restart inetd, or reboot your machine.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Fujitsu __ Not Affected
Notified: June 12, 2002 Updated: July 11, 2002
Status
Not Affected
Vendor Statement
Fujitsu’s UXP/V operating system is not affected by the vulnerability reported in VU#975403 because UXP/V does not support any CDE functionalties.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Cray Inc. __ Unknown
Notified: June 12, 2002 Updated: June 24, 2002
Status
Unknown
Vendor Statement
Cray, Inc. does include ToolTalk within the CrayTools product. However, rpc.ttdbserverd is not turned on or used by any Cray provided application. Since a site may have turned this on for their own use, they can always remove the binary /opt/ctl/bin/rpc.ttdbserverd if they are concerned.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Given the history of CDE source code, it is likely that the CrayTools ToolTalk RPC database server is vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Data General Unknown
Notified: June 12, 2002 Updated: June 13, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
The Open Group __ Unknown
Notified: June 12, 2002 Updated: July 11, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The Open Group maintains CDE code that is most likely vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
TriTeal __ Unknown
Updated: July 12, 2002
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
TriTeal went bankrupt in December 1999. It is possible that TriTeal Enterprise Desktop (TED) and CDE distributions based on TriTeal code are vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
View all 12 vendors __View less vendors __
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://www.corest.com/common/showdoc.php?idx=251&idxseccion=10
- <http://www.securityfocus.com/bid/5082>
Acknowledgements
The CERT/CC thanks Ricardo Quesada and Iván Arce of CORE SECURITY TECHNOLOGIES for reporting this vulnerability.
This document was written by Art Manion
Other Information
| CVE IDs: | CVE-2002-0677 |
|---|---|
| CERT Advisory: | CA-2002-20 Severity Metric: |
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
81.6%