CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
81.6%
The Common Desktop Environment (CDE) ToolTalk RPC database server does not adequately validate a client-supplied argument, allowing attackers to overwrite certain locations in memory with zeros. This vulnerability could be exploited in a number of ways, potentially allowing attackers to: cause a denial of service, remotely delete arbitrary files, remotely create arbitrary directories, and potentially execute arbitrary code or commands.
CORE SECURITY TECHNOLOGIES has reported a vulnerability in the CDE ToolTalk RPC database server (rpc.ttdbserverd
). A component of CDE, the ToolTalk architecture allows applications to communicate with each other via remote procedure calls (RPC) across different hosts and platforms. The ToolTalk RPC database server manages connections between ToolTalk applications. CDE and ToolTalk are installed and enabled by default on many common UNIX platforms.
ToolTalk clients can close a ToolTalk database by issuing an RPC request to the database server. During this process, a call is made to the procedure _TT_ISCLOSE(), and a file descriptor argument supplied by the client is used to reference a memory structure that contains information about the requested ToolTalk database. A memory location within the structure is set to zero (0L), ostensibly closing the requested database. The ToolTalk database server does not check the range of the file descriptor, so it is possible to reference a location in memory that is outside the region that contains valid database information. As a result, a specially crafted RPC call can cause specific memory locations in the ToolTalk database server process space to be set to zero. By issuing such a call, and also by controlling the contents of memory through other means, attackers could exploit this vulnerability in a number of different ways.
The CORE SECURITY TECHNOLOGIES report describes several different attacks including remotely deleting arbitrary files and remotely creating arbitrary directory entries. In addition, attackers might be able to crash the ToolTalk RPC database server, denying service to legitimate users. It could be possible for attackers to execute arbitrary code and commands, although this has not yet been demonstrated. The ToolTalk RPC database server typically runs with root privileges.
Apply a Patch
When available, apply a patch from your vendor.
Disable rpc.ttdbserverd
Until patches are available and can be applied, you may wish to consider disabling the ToolTalk RPC database service. As a general best practice, the CERT/CC recommends disabling any services that are not explicitly required. The ToolTalk RPC database service may be enabled in /etc/rpc
or in /etc/inetd.conf
. On a Solaris 8 system, comment out the following entry in /etc/inetd.conf
to disable the ToolTalk RPC database service (rpc.ttdbserverd
):
#
# Sun ToolTalk Database Server
#
100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
The rpcinfo(1M)
and ps(1)
commands may be useful in determining if you system is running the ToolTalk RPC database server. On a Solaris 8 system, the following examples indicate that the ToolTalk RPC database server is running:
# rpcinfo -p | grep 100083
100083 1 tcp 32773
# ps -ef | grep rpc.ttdbserverd
root 355 164 0 19:31:27 ? 0:00 rpc.ttdbserverd
Block or Restrict Access
Until patches are available and can be applied, block or restrict access to the RPC portmapper service and the ToolTalk RPC database service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block the ports used by the RPC portmapper and ToolTalk RPC services. The RPC portmapper service typically runs on ports 111/tcp and 111/udp. The ToolTalk RPC service may be configured to use port 692/tcp or another port as indicated in output from the rpcinfo
command. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network. It is important to understand your network configuration and service requirements before deciding what changes are appropriate.
975403
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: June 11, 2002 Updated: September 09, 2002
Affected
SOURCE: Compaq Computer Corporation, a wholly-owned subsidiary of Hewlett-Packard Company and Hewlett-Packard Company HP Services Software Security Response Team
CROSS REFERENCE: SSRT2251
At this time Compaq does have solutions in final testing and will publish HP Tru64 UNIX security bulletin (SSRT2251) with patch information as soon as testing has completed and kits are available from the support ftp web site.
A recommended workaround however is to disable rpc.ttdbserver until solutions are available. This should only create a potential problem for public software packages applications that use the RPC-based ToolTalk database server. This step should be evaluated against the risks identified, your security measures environment, and potential impact of other products that may use the ToolTalk database server.
To disable rpc.ttdbserverd:
* Comment out the following line in /etc/inetd.conf:
rpc.ttdbserverd stream tcp swait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
* Force inetd to re-read the configuration file by executing the inetd -h
command.
Note: The internet daemon should kill the currently running rpc.ttdbserver. If not, manually kill any existing rpc.ttdbserverd process.
The vendor has not provided us with any further information regarding this vulnerability.
Compaq (Hewlett-Packard) has released a security bulletin (SRB0039W/SSRT2251) that addresses VU#975403 and other vulnerabilities.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 11, 2002 Updated: August 15, 2002
Affected
`
The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
------------------------------------------------------------------ PROBLEM: Buffer overflow in rpc.ttdbserver
PLATFORM: HP9000 Series 700/800 running HP-UX releases 10.10, 10.20, 10.24, 11.00, 11.04, and 11.11.
DAMAGE: Potential unauthorized access, increased privileges.
SOLUTION: Until patches are available, manually install a replacement rpc.ttdbserver.
MANUAL ACTIONS: Install replacement rpc.ttdbserver.
AVAILABILITY: The replacement rpc.ttdbserver files are available now.
CHANGE SUMMARY: Added CA-2002-26 information
------------------------------------------------------------------ **REVISED 02** A. Background -->>Buffer overflows in rpc.ttdbserver has been reported by CERT -->>in CA-2002-20 and CA-2002-26. The potential exists to exploit -->>these overflows to gain unauthorized access.
B. Recommended solution Until patches are available, install the appropriate file to replace rpc.ttdbserver.
Note: The 10.20 file should be used for 10.24. The 11.00 file should be used for 11.04.
On 10.24 and 11.04 (VVOS) rpc.ttdbserver is disabled by default.
**REVISED 02** -->> 1. Download rpc.ttdbserver.2.tar.gz from the ftp site. This file is temporary and will be deleted when patches are available from the standard HP web sites, including itrc.hp.com.
System: hprc.external.hp.com (192.170.19.51) Login: ttdb1 Password: ttdb1
FTP Access: ``<ftp://ttdb1:[email protected]/>`` or: ``<ftp://ttdb1:[email protected]/>``
-->> file: rpc.ttdbserver.2.tar.gz
` Note: There is an ftp defect in IE5 that may result in
a browser hang. To work around this:
REVISED 02
HPSBUX9408-016
โ>> The md5 sum for rpc.ttdbserver.2.tar.gz is:
โ>> MD5 (rpc.ttdbserver.2.tar.gz) =
3. Install the new rpc.ttdbserver file using the
For example on a 10.20 system:
./install_rpc.ttdbserver rpc.ttdbserver.1020
4. The what(1) and cksum(1) outputs are:
REVISED 02
โ>>$ what rpc.ttdbserver.1010
โ>>$ cksum rpc.ttdbserver.1010
โ>>$ cksum rpc.ttdbserver.1020
โ>>$ cksum rpc.ttdbserver.1100
โ>>$ cksum rpc.ttdbserver.1111C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP IT Resource Center via electronic mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
``<http://itrc.hp.com>``
Use the 'Login' tab at the left side of the screen to login using your ID and password. Use your existing login or the "Register" button at the left to create a login, in order to gain access to many areas of the ITRC. Remember to save the User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other Technical Digests, click the check box (in the left column) for the appropriate digest and then click the "Update Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link (in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select the link for "The Security Bulletins Archive". (near the bottom of the page) Once in the archive the third link is to the current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. Security Patch Check completely automates the process of reviewing the patch matrix for 11.XX systems.
For information on the Security Patch Check tool, see: ``<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/>`` displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous ftp:
``<ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/>``
On the "Support Information Digest Main" page: click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
[email protected]
Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to [email protected].
Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes.
` Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
-----End of Document ID: HPSBUX0207-199--------------------------------------`
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 11, 2002 Updated: July 11, 2002
Affected
The CDE desktop product shipped with AIX is vulnerable to both the issues detailed above in the advisory. This affects AIX releases 4.3.3 and 5.1.0. An efix package will be available shortly from the IBM software ftp site. The efix packages can be downloaded from ftp.software.ibm.com/aix/efixes/security. This directory contains a README file that gives further details on the efix packages.
The following APARs will be available in the near future:
AIX 4.3.3: IY32368
AIX 5.1.0: IY32370
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 11, 2002 Updated: November 07, 2002
Affected
SGI acknowledges the ToolTalk vulnerabilities reported by CERT and is currently investigating. No further information is available at this time.
For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements. As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list on <http://www.sgi.com/support/security/>.
The vendor has not provided us with any further information regarding this vulnerability.
Please refer to SGI Security Advisories 20021101-01-P (CDE ToolTalk) and 20021102-01-P (IRIX ToolTalk).
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 11, 2002 Updated: July 10, 2002
Affected
The Solaris RPC-based ToolTalk database server, rpc.ttdbserverd, is vulnerable to the two vulnerabilities [VU#975403 VU#299816] described in this advisory in all currently supported versions of Solaris:
Solaris 2.5.1, 2.6, 7, 8, and 9
Patches are being generated for all of the above releases. Sun will publish a Sun Security Bulletin and a Sun Alert for this issue. The Sun Alert will be available from:
<http://sunsolve.sun.com>
The patches will be available from:
<http://sunsolve.sun.com/securitypatch>
Sun Security Bulletins are available from:
<http://sunsolve.sun.com/security>
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: September 13, 2002
Affected
Caldera Open UNIX and Caldera UnixWare provide the CDE ttdbserverd daemon, and are vulnerable to these issues. Please see Caldera Security Advisory CSSA-2002-SCO.28 for more information.
SCO OpenServer and Caldera OpenLinux do not provide CDE, and are therefore not vulnerable.
The vendor has not provided us with any further information regarding this vulnerability.
According to Calderaโs investigation, UnixWare 7.1.1 and Open UNIX 8.0.0 appear vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: June 13, 2002
Affected
Xi Graphics deXtop CDE v2.1 is vulnerable to this attack. A update correcting this issue will be available on our ftp site once this vulnerability has been publically announced.
Most sites do not need to use the ToolTalk server daemon. Xi Graphics Security recommends that non-essential services are never enabled. To disable the ToolTalk server on your system, edit /etc/inetd.conf and comment out, or remove, the โrpc.ttdbserverโ line. Then, either restart inetd, or reboot your machine.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: July 11, 2002
Not Affected
Fujitsuโs UXP/V operating system is not affected by the vulnerability reported in VU#975403 because UXP/V does not support any CDE functionalties.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: June 24, 2002
Unknown
Cray, Inc. does include ToolTalk within the CrayTools product. However, rpc.ttdbserverd is not turned on or used by any Cray provided application. Since a site may have turned this on for their own use, they can always remove the binary /opt/ctl/bin/rpc.ttdbserverd if they are concerned.
The vendor has not provided us with any further information regarding this vulnerability.
Given the history of CDE source code, it is likely that the CrayTools ToolTalk RPC database server is vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: June 13, 2002
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Notified: June 12, 2002 Updated: July 11, 2002
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The Open Group maintains CDE code that is most likely vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
Updated: July 12, 2002
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
TriTeal went bankrupt in December 1999. It is possible that TriTeal Enterprise Desktop (TED) and CDE distributions based on TriTeal code are vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23975403 Feedback>).
View all 12 vendors __View less vendors __
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
The CERT/CC thanks Ricardo Quesada and Ivรกn Arce of CORE SECURITY TECHNOLOGIES for reporting this vulnerability.
This document was written by Art Manion
CVE IDs: | CVE-2002-0677 |
---|---|
CERT Advisory: | CA-2002-20 Severity Metric: |