[CORE-20020528] Multiple vulnerabilities in ToolTalk Database server

                          CORE SECURITY TECHNOLOGIES
                                  http://www.corest.com

     Multiple vulnerabilities in Tooltalk database server

Date Published: 2002-07-10

Last Update: 2002-07-10

Advisory ID: CORE-20020528

Bugtraq ID: 5082,5083

CVE: CAN-2002-0677, CAN-2002-0678

CERT: VU#975403 VU#299816

Title: Multiple vulnerabilities in Tooltalk database server.

Class: Implementation flaws

Remotely Exploitable: Yes

Locally Exploitable: Yes

Vendors contacted:

• Sun
  CORE notification: 2002-06-10
  CERT notification: 2002-06-11 4:32pm
  Status:
  .Vulnerable (original bug discovery on Solaris)
  .Acknowledged notification on 2002-06-10
  .Research in progress, no confirmation
  from Sun as of 2002-06-18
  .Official statement forwardr by CERT: 2002-07-10

• HP
  CORE notification: 2002-06-10
  CERT notification: 2002-06-11
  Status:
  .Acknowledged notification on 2002-06-10
  .Confirmed HP-UX vulnerable on 2002-06-11
  and issued high priority lab fix request
  .Official statement forwarded by CERT: 2002-07-10

• Compaq Computer Corporation
  CORE notification: 2002-06-10
  CERT notification: 2002-06-11 4:32pm
  Status:
  .Acknowledged notification on 2002-06-10
  .Official statement forwarded by CERT: 2002-07-10

• SGI
  CORE notification: 2002-06-10
  CERT notification: 2002-06-11
  Status:
  .Acknowledged notification on 2002-06-18

• Xi Graphics (CDE for Linux)
  CERT notification: 2002-06-12
  Status:
  .Confirmed vulnerable, fixes are available
  at the release date of this advisory
  .Patches available : 2002-06-20

• IBM
  CORE notification: 2002-06-10
  CERT notification: 2002-06-11 4:32pm EST
  Status:
  .Confirmed vulnerable
  .Official statement forwarded by CERT: 2002-07-10

• Caldera (SCO)
  CERT notification: 2002-06-12 1:32pm
  Status:
  .Confirmed vulnerable
  .Official statement forwarded by CERT: 2002-07-10

• Cray Inc.
  CERT notification: 2002-06-12 1:19pm
  Status:
  .Acknoledged notification.
  "Cray Inc. ships ToolTAlk wiht the CrayTools
  product but is not enabled by default or used
  by any Cray provided application"

• Data General
  CERT notification: 2002-06-12 1:19pm
  Status:
  N/A

• Fujitsu
  CERT notification: 2002-06-12 1:19pm
  Status:
  .Acknowledged notification.
  "Fujitsu's UXP/V is not vulnerable. Does
  not support any CDE functionalities"

• The Open Group
  CERT notification: 2002-06-12 1:31pm
  Status:
  N/A

Release Mode: USER RELEASE

Vulnerability Description:

The ToolTalk service allows independently developed applications to
communicate with each other by exchanging ToolTalk messages. Using ToolTalk,
applications can create open protocols which allow different programs to be
interchanged, and new programs to be plugged into the system with minimal
reconfiguration.

The ToolTalk database server (rpc.ttdbserverd) is an ONC RPC service which
manages objects needed for the operation of the ToolTalk service.
ToolTalk-enabled processes communicate with each other using RPC calls to
this program, which runs on each ToolTalk-enabled host. This program is a
standard component of the ToolTalk system, which ships as a standard
component of many commercial Unix operating systems. The ToolTalk database
server runs as root.

Several security bugs were discovered in the rpc.ttdbserverd program
that allow an attacker to:

• Overwrite 4 bytes of memory the running process with a zero
  (0x0L) value
• Remotely delete any file on the vulnerable host
• Locally create or overwrite any file on the vulnerable host
  with arbitrary contents.
• Remotely create arbitrary directory entries on the vulnerable
  host

These vulnerabilities by themselves can lead to remote and local
compromise of the privilege root account on the vulnerable system.

Additionally these vulnerabilities may be used to build more reliable
and effective exploit programs for previously published ToolTalk
Database server vulnerabilities.

Exploit modules for the vulnerabilities described in this advisory
are available inmediately for CORE IMPACT customers through the
product support channel or as part of CORE IMPACT v1.1 or
the July 2002 module update pack.

Vulnerable Packages:
Solaris 2.5.1 2.6 7 8 9
HP-UX 10.10 10.20 11.00 11.11
Tru64 v4.0f, v4.0g, v5.0a, v5.1, v5.1a
Xi Graphics deXtop CDE v2.1
IBM AIX 4.3.3 and 5.1.0
Caldera Open UNIX and Caldera UNIXware

Not confirmed but suspected vulnerable

• SGI IRIX 5.2-6.5.x

Not vulnerable

• Fujitsu UXP/V
• Cray Inc, CrayTools
• Caldera OpenLinux
• SCO OpenServer

Solution/Vendor Information/Workaround

Caldera, Inc.

Caldera Open UNIX and Caldera UnixWare provide the
CDE ttdbserverd daemon, and are vulnerable to these issues.
We have prepared fixes for those two operating systems,
and will make them available as soon as these issues are
made public.

SCO OpenServer and Caldera OpenLinux do not provide CDE,
and are therefore not vulnerable.

Compaq Computer Corporation

CROSS REFERENCE: SSRT2251

At this time Compaq does have solutions in final testing
and will publish HP Tru64 UNIX security bulletin
(SSRT2251) with patch information as soon as testing has
completed and kits are available from the support ftp web
site.

A recommended workaround however is to disable
rpc.ttdbserver until solutions are available. This
should only create a potential problem for public
software packages applications that use the RPC-based
ToolTalk database server. This step should be evaluated
against the risks identified, your security measures
environment, and potential impact of other products that
may use the ToolTalk database server.

To disable rpc.ttdbserverd:

• Comment out the following line in /etc/inetd.conf:
  rpc.ttdbserverd stream tcp swait root
  /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
• Force inetd to re-read the configuration file by
  executing the inetd -hcommand.

Note: The internet daemon should kill the currently
running rpc.ttdbserver. If not, manually kill any
existing rpc.ttdbserverd process.

Cray, Inc.

Cray, Inc. does include ToolTalk within the CrayTools
product. However, rpc.ttdbserverd is not turned on or used
by any Cray provided application. Since a site may have
turned this on for their own use, they can always
remove the binary /opt/ctl/bin/rpc.ttdbserverd if they
are concerned.

Fujitsu

Fujitsu's UXP/V operating system is not affected by
the vulnerability reported in VU#975403 [or VU#299816]
because UXP/V does not support any CDE functionalties.

Hewlett-Packard Company

HP9000 Series 700/800 running HP-UX releases 10.10,
10.20, 11.00, and 11.11 are vulnerable.

Until patches are available, install the appropriate file
to replace rpc.ttdbserver.

Download rpc.ttdbserver.tar.gz from the ftp site. This file
is temporary and will be deleted when patches are
available from the standard HP web sites, including
itrc.hp.com.

System: hprc.external.hp.com (192.170.19.51)
Login: ttdb1
Password: ttdb1
FTP Access: ftp://ttdb1:[email protected]/
ftp://ttdb1:[email protected]/
File: rpc.ttdbserver.tar.gz
MD5: da1be3aaf70d0e2393bd9a03feaf4b1d

An HP security bulletin will be released with more
information.

IBM Corporation

The CDE desktop product shipped with AIX is vulnerable to
both the issues detailed above in the advisory. This
affects AIX releases 4.3.3 and 5.1.0 An efix package
will be available shortly from the IBM software ftp site.
The efix packages can be downloaded from
ftp.software.ibm.com/aix/efixes/security. This directory
contains a README file that gives further details on
the efix packages.

The following APARs will be available in the near future:

AIX 4.3.3: IY32368
AIX 5.1.0: IY32370

SGI

SGI acknowledges the ToolTalk vulnerabilities reported by
CERT and is currently investigating. No further
information is available at this time.

For the protection of all our customers, SGI does not
disclose, discuss or confirm vulnerabilities until a full
investigation has occurred and any necessary patch(es) or
release streams are available for all vulnerable and
supported IRIX operating systems. Until SGI has more
definitive information to provide, customers are encouraged
to assume all security vulnerabilities as exploitable and
take appropriate steps according to local site security
policies and requirements. As further information becomes
available, additional advisories will be issued via the
normal SGI security information distribution methods
including the wiretap mailing list on
http://www.sgi.com/support/security/.

Sun Microsystems, Inc.

The Solaris RPC-based ToolTalk database
server, rpc.ttdbserverd, is vulnerable to the two
vulnerabilities [VU#975403 VU#299816] described in this
advisory in all currently supported versions of Solaris:

Solaris 2.5.1, 2.6, 7, 8, and 9

Patches are being generated for all of the above releases.
Sun will publish a Sun Security Bulletin and a Sun Alert
for this issue. The Sun Alert will be available from:

http://sunsolve.sun.com

The patches will be available from:

http://sunsolve.sun.com/securitypatch

Sun Security Bulletins are available from:

http://sunsolve.sun.com/security

The Open Group

N/A

Xi Graphics

Xi Graphics deXtop CDE v2.1 is vulnerable to this
attack. A update correcting this issue will be available on
our ftp site once this vulnerability has been publically
announced.

When announced, the update and accompanying text file will
be:

ftp://ftp.xig.com/pub/updates/dextop/2.1/DEX2100.016.tar.gz
ftp://ftp.xig.com/pub/updates/dextop/2.1/DEX2100.016.txt

Most sites do not need to use the ToolTalk server daemon.
Xi Graphics Security recommends that non-essential
services are never enabled. To disable the ToolTalk server
on your system, edit /etc/inetd.conf and comment
out, or remove, the 'rpc.ttdbserver' line. Then,
either restart inetd, or reboot your machine.

Workarounds

If patches are not available from your vendor these
workarounds can be implemented:

• Disable the vulnerable service
  To do so, it is needed to comment out or remove the
  lines that refer to rpc.ttdbserverd in /etc/inetd.conf
  and restart the inetd daemon.

• Block connections to the vulnerable service
  Block access from untrusted networks to the ToolTalk
  Database server program.
  The program is identified as RPC program number
  100083 and may service requests on port 629/tcp
  or any other port. Use the rpcinfo program to
  determine on which port ttdbserver is servicing
  requests and block access to that port and the
  portmapper (111/tcp 111/udp) at the perimeter.
  This will not prevent exploitation from trusted
  networks.
  In general it is advisable to block access from
  untrusted networks to ALL RPC services.

Credits:

These vulnerabilities were discovered and researched by Ricardo Quesada
of the CORE IMPACT team at CORE Security Technologies.
We would like to thank CERT for their efforts coordinating the
release of this advisory with CORE and the vendors.

Technical Description - Exploit/Concept Code

1) Overwriting portions of memory with 0L

The _TT_ISCLOSE procedure in ttdbserverd allows a client to close
an open ToolTalk Database. The client needs only to perform a
client call to the mentioned procedure passing a valid file descriptor
as argument.

The server first checks if the authentication credentials passed in
the procedure call (AUTH_UNIX) are valid for the requested operation.
To do so, the server uses the file descriptor received as argument
to index into a statically allocated table of structs of 24 bytes
each named _tt_db_table.
The table has 128 entries and each entry contains an struct with
the following fields (the names given to the fields were chosen
arbitrarly):

struct _tt_db_table_entry {
char * path;
int uid;
int mode;
int isopen;
int isopen2;
int aux;
};

The value in uid specifies the owner of the open database and
a non zero value in the isopen field indicates that the file is
open and in use.
Once the file is closed (or even if the operation fails) the
_TT_ISCLOSE procedure resets the value of the isopen field to 0
to indicate that this entry in the table belongs to a file
that is no longer open and in use.

A failure to perform proper range checks on the file descriptor
used as index into the table allows an attacker to specify arbitrary
portions of memory as table entries.
By abusing this vulnerability an attacker could use the _TT_ISCLOSE
procedure to overwrite portions of memory with a value of 0L.
This attack is restricted to overwritting portions of memory at
24 bytes intervals (since that is the overall size of each
table entry).
As we will see, the ability to do so will provide the means
to perform more sophisticated attacks.

2) Deleting files remotely

The ttdbserverd program provides also a procedure to log
transactions on a ToolTalk Database to a logfile. For this
purpose the _TT_TRANSACTION procedure is used.

_TT_TRANSACTION receives a file descriptor and a list of
records to log to the log file.
The filename for the logfile is kept in a statically allocated
variable _tt_log_file.

Upon failure of a transaction operation, a generic error
handler function is called and the logfile is deleted from
the filesystem using the unlink() function call.

In Solaris 8 ( patch 110286-6 applied) the variable is located
at:
0x0007636c 0x00000401 OBJT GLOB 0 .bss _tt_log_file

The filename for the log file is generated by concatenating the
full pathname for the TT Database and the fixed string 'log_file'.

The variable is populated by the _TT_ISOPEN and _TT_TRANSACTION
procedures, available to any local or remote ttdbserverd client.

A client can create a new TT database using the _TT_ISBUILD
procedure call and subsequently use the _TT_TRANSACTION
procedure to log transations on the newly created database
to the file specified in _tt_log_file.

As described above, _TT_TRANSACTION will populate the
_tt_log_file variable with the filename of the TT Database
concatenated with the string 'log_file'.
Therefore by creating (using _TT_ISBUILD) a TTDB named
"////////etc/passwd012345689ABCDEF/file_table" and subsequently
calling _TT_TRANSACTION with the valid file descriptor
for that DB (received as result of the ISBUILD call)
the _tt_log_file variable will end up as:

_tt_log_file = "////////etc/passwd012345689ABCDEF/log_file"

An attacker can now abuse the vulnerability described in
1) to insert a zero (and null terminate the string) leaving
the _tt_log_file variable as follows:

_tt_log_file = "////////etc/passwd\0\0\0\045689ABCDEF/log_file"

Once this has been done, a call to _TT_TRANSACTION with
an invalid file descriptor as argument (i.e. -2) will
trigger the unlink in the error handler function, effectively
removing the file specified in the _tt_log_file variable
from the file system.

This technique can be used by an attacker to remove any
file or directory on the vulnerable host.

3) Creating / Overwriting any local file

The _TT_TRANSACTION procedure follows symlinks when opening
the log file in order to write the transaction log.
By using a combination of the techniques described above an
attacker can locally overwrite any file with any contents
of her choice since the list of transaction records to log
is passed by the client program.

Conclusion

This advisory describes techniques to abuse two
vulnerabilities found in the CDE ttdbserver program:

• Improper checks on user suplied RPC arguments that
  lead to memory overwriting.
  BID:5082 CERT: VU#975403 CVE:CAN-2002-0677

  This is the file descriptor range check problem
  described in 1) and later used in 2)

• Lack of file system checks for file operations that
  lead to local file creation or overwriting.
  This is the symlink problem described in 3)
  BID:5083 CERT: VU#299816 CVE: CAN-2002-0678

The vulnerabilities and techniques described in this
advisory can be abused by an attacker in order to gain
privileged access to a vulnerable system both remotelly
and locally, or in order to perform a denial of service
attack (ie. deletion of ANY file remotely)

It is relevant to mention that vulnerabilities
disclosed very recently (see BID:4639/CVE:NOT-ASSIGNED
and BID:3382 /CVE:CAN-2001-0717) rely on the attacker's ability
to make file system operations to fail in order
to exploit those bugs.

Additionally, the ability to overwrite any portion
of the process memory with a value of 0L may provide
other possible attack scenarios for remote or local
compromise of the vulnerable host.

DISCLAIMER:

The contents of this advisory are copyright (c) 2002 CORE Security
Technologies and may be distributed freely provided that no fee is charged
for this distribution and proper credit is given.

$Id: ttdbserver.txt,v 1.9 2002/07/11 00:27:43 iarce Exp $

---

Perscriptio in manibus tabellariorum est
Noli me vocare, ego te vocabo

Ivan Arce
CTO
CORE SECURITY TECHNOLOGIES

44 Wall Street - New York, NY 10005
Ph: (212) 461-2345
Fax: (212) 461-2346
http://www.corest.com

PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836 B25D 207B E78E 2AD1 F65A

— for a personal reply use: =?iso-8859-1?Q?Iv=E1n_Arce?=
<[email protected]>