Vulnerability Note VU#172583

Internet Security Systems (ISS) X-Force has reported a remotely exploitable buffer overflow in the Common Desktop Environment (CDE) Subprocess Control Service (dtspcd). CDE is an integrated graphical user interface that runs on Unix and Linux operating systems. dtspcd is a network daemon that accepts requests from clients to execute commands and launch applications remotely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges. dtspcd makes a function call to a shared library, libDTSvc.so.1, that contains a buffer overflow condition in the client connection routine. The buffer overflow can be exploited by a specially crafted CDE client request. Although the buffer overflow occurs in a shared library, the CERT/CC is not aware of any other CDE applications that use the vulnerable function.

A successful attacker can execute arbitrary code remotely with root privileges.

Apply Patch

Apply the appropriate vendor supplied patch as described in the vendor section below.

Disable Vulnerable Service

Until a patch can be applied, you may wish to consider disabling dtspcd. Typically, this may be achieved by commenting out the approprate entry in /etc/inetd.conf. As a general practice, CERT/CC recommends disabling any services that are not explicitly required. It is important to carefully consider the consequences of disabling dtspcd in your environment.

/etc/inetd.conf

dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd