Vulnerability Note VU#172583
Common Desktop Environment (CDE) Subprocess Control Service dtspcd contains buffer overflow
A remotely exploitable buffer overflow exists in the Common Desktop Environment (CDE) Subprocess Control Service (dtspcd). An attacker who successfully exploits this vulnerability can execute arbitrary code as root.
Internet Security Systems (ISS) X-Force has reported a remotely exploitable buffer overflow in the Common Desktop Environment (CDE) Subprocess Control Service (dtspcd). CDE is an integrated graphical user interface that runs on Unix and Linux operating systems. dtspcd is a network daemon that accepts requests from clients to execute commands and launch applications remotely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges. dtspcd makes a function call to a shared library, libDTSvc.so.1, that contains a buffer overflow condition in the client connection routine. The buffer overflow can be exploited by a specially crafted CDE client request. Although the buffer overflow occurs in a shared library, the CERT/CC is not aware of any other CDE applications that use the vulnerable function.
A successful attacker can execute arbitrary code remotely with root privileges.
Apply the appropriate vendor supplied patch as described in the vendor section below.
Monitor or block external access to 6112/tcp. It may be possible to use TCP Wrapper or a similar technology to provide improved access control and logging. Additionally, an application-level firewall may be able to filter requests made to dtspcd.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Compaq Computer Corporation||Affected||29 Oct 2001||30 May 2002|
|Hewlett-Packard Company||Affected||29 Oct 2001||08 Mar 2002|
|IBM||Affected||29 Oct 2001||11 Aug 2003|
|SGI||Affected||29 Oct 2001||03 Apr 2002|
|Sun Microsystems Inc.||Affected||29 Oct 2001||10 Jan 2002|
|The Open Group||Affected||29 Oct 2001||12 Nov 2001|
|The SCO Group (SCO UnixWare)||Affected||29 Oct 2001||13 Sep 2002|
|Xi Graphics||Affected||29 Oct 2001||15 Nov 2001|
|Cray Inc.||Not Affected||29 Oct 2001||31 Oct 2001|
|Fujitsu||Not Affected||29 Oct 2001||31 Oct 2001|
|Data General||Unknown||29 Oct 2001||31 Oct 2001|
|TriTeal||Unknown||-||12 Nov 2001|
CVSS Metrics (Learn More)
This vulnerability was reported to the CERT Coordination Center by Internet Security Systems (ISS) X-Force.
This document was written by Art Manion.
- CVE IDs: CVE-2001-0803
- CERT Advisory: CA-2001-31
- Date Public: 07 Nov 2001
- Date First Published: 12 Nov 2001
- Date Last Updated: 11 Aug 2003
- Severity Metric: 16.30
- Document Revision: 45
If you have feedback, comments, or additional information about this vulnerability, please send us email.