search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file operations

Vulnerability Note VU#299816

Original Release Date: 2002-07-11 | Last Revised: 2002-08-15

Overview

The Common Desktop Environment (CDE) ToolTalk RPC database server does not adequately validate file operations and follows symbolic links, allowing a local attacker to overwrite any file that is writeable by the server. The ToolTalk RPC database server typically runs with root privileges.

Description

CORE SECURITY TECHNOLOGIES has reported a vulnerability in the CDE ToolTalk RPC database server (rpc.ttdbserverd). A component of CDE, the ToolTalk architecture allows applications to communicate with each other via remote procedure calls (RPC) across different hosts and platforms. The ToolTalk RPC database server manages connections between ToolTalk applications. CDE and ToolTalk are installed and enabled by default on many common UNIX platforms.

Certain ToolTalk RPC database functions, among them _TT_TRANSACTION(), create and write to files that are referenced by user-supplied path and filename arguments. The ToolTalk RPC database server does not check that the file used in a create or write operation is not a symbolic link. By first creating a symbolic link, then issuing a specially crafted RPC call, a local attacker can overwrite the target of the symbolic link with arbitrary contents.

Impact

A local attacker could overwrite any file writeable by the ToolTalk RPC database server. This technique could be used to gain the privileges of the ToolTalk RPC database server, typically root.

Solution


Apply a Patch

When available, apply a patch from your vendor.


Disable rpc.ttdbserverd

Until patches are available and can be applied, you may wish to consider disabling the ToolTalk RPC database service. As a general best practice, the CERT/CC recommends disabling any services that are not explicitly required. The ToolTalk RPC database service may be enabled in /etc/rpc or in /etc/inetd.conf. On a Solaris 8 system, comment out the following entry in /etc/inetd.conf to disable the ToolTalk RPC database service (rpc.ttdbserverd):

#
# Sun ToolTalk Database Server
#
100083/1        tli     rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd

The rpcinfo(1M) and ps(1) commands may be useful in determining if you system is running the ToolTalk RPC database server. On a Solaris 8 system, the following examples indicate that the ToolTalk RPC database server is running:

# rpcinfo -p | grep 100083
    100083    1   tcp   32773

# ps -ef | grep rpc.ttdbserverd
    root   355   164  0  19:31:27 ?        0:00 rpc.ttdbserverd

Block or Restrict Access

Until patches are available and can be applied, block or restrict access to the RPC portmapper service and the ToolTalk RPC database service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block the ports used by the RPC portmapper and ToolTalk RPC services. The RPC portmapper service typically runs on ports 111/tcp and 111/udp. The ToolTalk RPC service may be configured to use port 692/tcp or another port as indicated in output from the rpcinfo command. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network. It is important to understand your network configuration and service requirements before deciding what changes are appropriate.

Vendor Information

299816
Expand all

Compaq Computer Corporation

Notified:  June 11, 2002 Updated:  September 09, 2002

Status

  Vulnerable

Vendor Statement

SOURCE: Compaq Computer Corporation, a wholly-owned subsidiary of Hewlett-Packard Company and Hewlett-Packard Company HP Services Software Security Response Team

CROSS REFERENCE: SSRT2251

At this time Compaq does have solutions in final testing and will publish HP Tru64 UNIX security bulletin (SSRT2251) with patch information as soon as testing has completed and kits are available from the support ftp web site.

A recommended workaround however is to disable rpc.ttdbserver until solutions are available. This should only create a potential problem for public software packages applications that use the RPC-based ToolTalk database server. This step should be evaluated against the risks identified, your security measures environment, and potential impact of other products that may use the ToolTalk database server.

To disable rpc.ttdbserverd:

    • Comment out the following line in /etc/inetd.conf:
    rpc.ttdbserverd  stream tcp swait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd
    • Force inetd to re-read the configuration file by executing the inetd -h command.
Note: The internet daemon should kill the currently running rpc.ttdbserver. If not, manually kill any existing rpc.ttdbserverd process.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Compaq (Hewlett-Packard) has released a security bulletin (SRB0039W/SSRT2251) that addresses VU#299816 and other vulnerabilities.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company

Notified:  June 11, 2002 Updated:  August 15, 2002

Status

  Vulnerable

Vendor Statement

 -----------------------------------------------------------------
**REVISED 02**
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0207-199
Originally issued:  12 July 2002
Last revision: 14 Aug 2002
SSRT2274 Sec. Vulnerability in rpc.ttdbserver
-----------------------------------------------------------------

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 ------------------------------------------------------------------
PROBLEM:  Buffer overflow in rpc.ttdbserver

PLATFORM: HP9000 Series 700/800 running HP-UX releases 10.10,
         10.20, 10.24, 11.00, 11.04, and 11.11.

DAMAGE:  Potential unauthorized access, increased privileges.

SOLUTION: Until patches are available, manually install a
         replacement rpc.ttdbserver.

MANUAL ACTIONS: Install replacement rpc.ttdbserver.

AVAILABILITY:  The replacement rpc.ttdbserver files are
               available now.

CHANGE SUMMARY: Added CA-2002-26 information

 ------------------------------------------------------------------
**REVISED 02**
A. Background
-->>Buffer overflows in rpc.ttdbserver has been reported by CERT
-->>in CA-2002-20 and CA-2002-26.  The potential exists to exploit
-->>these overflows to gain unauthorized access.

 B. Recommended solution
   Until patches are available, install the appropriate file to
   replace rpc.ttdbserver.

     Note: The 10.20 file should be used for 10.24.
          The 11.00 file should be used for 11.04.

           On 10.24 and 11.04 (VVOS) rpc.ttdbserver is disabled
          by default.

**REVISED 02**
-->>  1. Download rpc.ttdbserver.2.tar.gz from the ftp site.
        This file is temporary and will be deleted when patches
        are available from the standard HP web sites, including
        itrc.hp.com.

        System:    hprc.external.hp.com  (192.170.19.51)
       Login:     ttdb1
       Password:  ttdb1

        FTP Access: ftp://ttdb1:ttdb1@hprc.external.hp.com/
              or:
ftp://ttdb1:ttdb1@192.170.19.51/

-->>    file: rpc.ttdbserver.2.tar.gz

        Note: There is an ftp defect in IE5 that may result in
              a browser hang.  To work around this:
       - Select Tools -> Internet Options -> Advanced
       - Un-check the option: [ ] Enable folder view for FTP sites

**REVISED 02**
-->>  2. Copy the rpc.ttdbserver.2.tar.gz file to a protected
        directory and unpack it.
        If you wish to verify the md5 sum before unpacking the
        rpc.ttdbserver.tar.gz file, please refer to:

               HPSBUX9408-016
              Patch sums and the MD5 program

-->>      The md5 sum for rpc.ttdbserver.2.tar.gz is:

-->>  MD5 (rpc.ttdbserver.2.tar.gz) =
-->>                 e6af458213a9834146f716c9df7f1aaf

      3. Install the new rpc.ttdbserver file using the
        install_rpc.ttdbserver script or some similar procedure.
        The install_rpc.ttdbserver script is included in
-->>     rpc.ttdbserver.2.tar.gz.

         For example on a 10.20 system:

            ./install_rpc.ttdbserver rpc.ttdbserver.1020

      4. The what(1) and cksum(1) outputs are:

**REVISED 02**
 ###################################################

-->>$ what rpc.ttdbserver.1010
-->>rpc.ttdbserver.1010:
-->>    X Window System, Version 11 R5+ HP-UX B.10.10.020810 -O
-->>    (build date: Sat Aug 10 13:35:19 IST 2002)
-->>    rpc.ttdbserver: $Revision: 1.1 $

-->>$ cksum rpc.ttdbserver.1010
-->>2536143200 323584 rpc.ttdbserver.1010
 ###################################################
-->>$ what rpc.ttdbserver.1020
-->>rpc.ttdbserver.1020:
-->>    X Window System, Version 11 R6+ HP-UX B.10.20.020810 +O2
-->>    (build date: Sat Aug 10 12:56:54 IST 2002)
-->>    rpc.ttdbserver: $Revision: 1.1 $

-->>$ cksum rpc.ttdbserver.1020
-->>1981972883 323584 rpc.ttdbserver.1020
 ###################################################
-->>$ what rpc.ttdbserver.1100
-->>rpc.ttdbserver.1100:
-->> View: /view/venu_main, Build Type: r6hp700_1100
-->>    hpcde2.1
-->>    (build date: Fri Aug  9 10:49:13 IST 2002)
-->>  [rest deleted]

-->>$ cksum rpc.ttdbserver.1100
-->>3680305777 327680 rpc.ttdbserver.1100
 ###################################################
-->>$ what rpc.ttdbserver.1111
-->>rpc.ttdbserver.1111:
-->>    View: /view/venu_main, Build Type: r6hp700_1111
-->>    hpcde2.1
-->>    (build date: Fri Aug  9 11:37:48 IST 2002)
-->>  [rest deleted]

-->>$ cksum rpc.ttdbserver.1111
-->>595997811 352256 rpc.ttdbserver.1111
 ###################################################



 C. To subscribe to automatically receive future NEW HP Security
   Bulletins from the HP IT Resource Center via electronic
   mail, do the following:

    Use your browser to get to the HP IT Resource Center page
   at:

       http://itrc.hp.com

    Use the 'Login' tab at the left side of the screen to login
   using your ID and password.  Use your existing login or the
   "Register" button at the left to create a login, in order to
   gain access to many areas of the ITRC.  Remember to save the
   User ID assigned to you, and your password.

    In the left most frame select "Maintenance and Support".

    Under the "Notifications" section (near the bottom of
   the page), select "Support Information Digests".

    To -subscribe- to future HP Security Bulletins or other
   Technical Digests, click the check box (in the left column)
   for the appropriate digest and then click the "Update
   Subscriptions" button at the bottom of the page.

    or

    To -review- bulletins already released, select the link
   (in the middle column) for the appropriate digest.

    To -gain access- to the Security Patch Matrix, select
   the link for "The Security Bulletins Archive".  (near the
   bottom of the page)  Once in the archive the third link is
   to the current Security Patch Matrix. Updated daily, this
   matrix categorizes security patches by platform/OS release,
   and by bulletin topic.  Security Patch Check completely
   automates the process of reviewing the patch matrix for
   11.XX systems.

    For information on the Security Patch Check tool, see:
   
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
   displayProductInfo.pl?productNumber=B6834AA"

    The security patch matrix is also available via anonymous
   ftp:

    ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

    On the "Support Information Digest Main" page:
   click on the "HP Security Bulletin Archive".

 D. To report new security vulnerabilities, send email to

    security-alert@hp.com

    Please encrypt any exploit information using the
   security-alert PGP key, available from your local key
   server, or by sending a message with a -subject- (not body)
   of 'get key' (no quotes) to security-alert@hp.com.

    Permission is granted for copying and circulating this
   Bulletin to Hewlett-Packard (HP) customers (or the Internet
   community) for the purpose of alerting them to problems,
   if and only if, the Bulletin is not edited or changed in
   any way, is attributed to HP, and provided such reproduction
   and/or distribution is performed for non-commercial purposes.

    Any other use of this information is prohibited. HP is not
   liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID:  HPSBUX0207-199--------------------------------------

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM

Notified:  June 11, 2002 Updated:  July 11, 2002

Status

  Vulnerable

Vendor Statement

The CDE desktop product shipped with AIX is vulnerable to both the issues detailed above in the advisory. This affects AIX releases 4.3.3 and 5.1.0. An efix package will be available shortly from the IBM software ftp site. The efix packages can be downloaded from ftp.software.ibm.com/aix/efixes/security. This directory contains a README file that gives further details on the efix packages.

The following APARs will be available in the near future:

    AIX 4.3.3: IY32368

    AIX 5.1.0: IY32370

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SGI

Notified:  June 11, 2002 Updated:  November 07, 2002

Status

  Vulnerable

Vendor Statement

SGI acknowledges the ToolTalk vulnerabilities reported by CERT and is currently investigating. No further information is available at this time.

For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements. As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list on http://www.sgi.com/support/security/.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please refer to SGI Security Advisories 20021101-01-P (CDE ToolTalk) and 20021102-01-P (IRIX ToolTalk).

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sun Microsystems Inc.

Notified:  June 11, 2002 Updated:  July 11, 2002

Status

  Vulnerable

Vendor Statement

The Solaris RPC-based ToolTalk database server, rpc.ttdbserverd, is vulnerable to the two vulnerabilities [VU#975403 VU#299816] described in this advisory in all currently supported versions of Solaris:

Solaris 2.5.1, 2.6, 7, 8, and 9

Patches are being generated for all of the above releases. Sun will publish a Sun Security Bulletin and a Sun Alert for this issue. The Sun Alert will be available from:

http://sunsolve.sun.com

The patches will be available from:

http://sunsolve.sun.com/securitypatch

Sun Security Bulletins are available from:

http://sunsolve.sun.com/security

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

The SCO Group (SCO UnixWare)

Notified:  June 12, 2002 Updated:  September 13, 2002

Status

  Vulnerable

Vendor Statement

Caldera Open UNIX and Caldera UnixWare provide the CDE ttdbserverd daemon, and are vulnerable to these issues. Please see Caldera Security Advisory CSSA-2002-SCO.28 for more information.

SCO OpenServer and Caldera OpenLinux do not provide CDE, and are therefore not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to Caldera's investigation, UnixWare 7.1.1 and Open UNIX 8.0.0 appear vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Xi Graphics

Notified:  June 12, 2002 Updated:  July 11, 2002

Status

  Vulnerable

Vendor Statement

Xi Graphics deXtop CDE v2.1 is vulnerable to this attack. A update correcting this issue will be available on our ftp site once this vulnerability has been publically announced.

Most sites do not need to use the ToolTalk server daemon. Xi Graphics Security recommends that non-essential services are never enabled. To disable the ToolTalk server on your system, edit /etc/inetd.conf and comment out, or remove, the 'rpc.ttdbserver' line. Then, either restart inetd, or reboot your machine.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fujitsu

Notified:  June 12, 2002 Updated:  July 11, 2002

Status

  Not Vulnerable

Vendor Statement

Fujitsu's UXP/V operating system is not affected by the vulnerability reported in VU#975403 because UXP/V does not support any CDE functionalties.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cray Inc.

Notified:  June 12, 2002 Updated:  July 11, 2002

Status

  Unknown

Vendor Statement

Cray, Inc. does include ToolTalk within the CrayTools product. However, rpc.ttdbserverd is not turned on or used by any Cray provided application. Since a site may have turned this on for their own use, they can always remove the binary /opt/ctl/bin/rpc.ttdbserverd if they are concerned.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Given the history of CDE source code, it is likely that the CrayTools ToolTalk RPC database server is vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Data General

Notified:  June 12, 2002 Updated:  July 11, 2002

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

The Open Group

Notified:  June 12, 2002 Updated:  July 11, 2002

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Open Group maintains CDE code that is most likely vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

TriTeal

Updated:  July 12, 2002

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

TriTeal went bankrupt in December 1999. It is possible that TriTeal Enterprise Desktop (TED) and CDE distributions based on TriTeal code are vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

The CERT/CC thanks Ricardo Quesada and Iván Arce of CORE SECURITY TECHNOLOGIES for reporting this vulnerability.

This document was written by Art Manion.

Other Information

CVE IDs: CVE-2002-0678
CERT Advisory: CA-2002-20
Severity Metric: 12.18
Date Public: 2002-07-10
Date First Published: 2002-07-11
Date Last Updated: 2002-08-15 22:38 UTC
Document Revision: 11

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.