CERT Advisory CA-2001-31 Buffer Overflow in CDE Subprocess Control Service

Original release date: November 12, 2001
Last revised: May 30, 2002
Source: CERT/CC

A complete revision history can be found at the end of this file.

Systems Affected

Systems running CDE

Overview

There is a remotely exploitable buffer overflow vulnerability in a library function used by the CDE Subprocess Control Service. This vulnerability could be used to crash the service or to execute arbitrary code with root privileges. This vulnerability is documented in VU#172583.

I. Description

The Common Desktop Environment (CDE) is an integrated graphical user interface that runs on UNIX and Linux operating systems. The CDE Subprocess Control Service (dtspcd) is a network daemon that accepts requests from clients to execute commands and launch applications remotely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges.

For more information about CDE, see

http://www.opengroup.org/cde/

http://www.opengroup.org/desktop/faq/

There is a remotely exploitable buffer overflow vulnerability in a shared library that is used by dtspcd. During client negotiation, dtspcd accepts a length value and subsequent data from the client without performing adequate input validation. As a result, a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges.

This vulnerability was first reported to us in March 1999, and more recently by Internet Security Systems (ISS) X-Force. For more information, see

http://www.kb.cert.org/vuls/id/172583

http://xforce.iss.net/alerts/advise101.php

This vulnerability has been assigned the identifier CAN-2001-0803 by the Common Vulnerabilities and Exposures (CVE) group:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0803

Many common UNIX systems ship with CDE installed and enabled by default. To determine if your system is configured to run dtspcd, check for the following entries (may be wrapped):

/etc/services

dtspc 6112/tcp

/etc/inetd.conf

dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd

Any system that does not run the CDE Subprocess Control Service is not vulnerable to this problem.

II. Impact

An attacker can execute arbitrary code with root privileges.

III. Solution

Apply a patch

Appendix A contains information from vendors who have provided information for this advisory. We will update the appendix as we receive more information. If a vendor's name does not appear, then the CERT/CC did not hear from that vendor. Please contact your vendor directly.

Limit access to vulnerable service

Until patches are available and can be applied, you may wish to limit or block access to the Subprocess Control Service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block or restrict access to the port used by the Subprocess Control Service. As noted above, dtspcd is typically configured to listen on port 6112/tcp. It may be possible to use TCP Wrapper or a similar technology to provide improved access control and logging functionality for dtspcd connections. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network. It is important to understand your network configuration and service requirements before deciding what changes are appropriate. TCP Wrapper is available from

ftp://ftp.porcupine.org/pub/security/index.html

Disable vulnerable service

You may wish to consider disabling dtspcd by commenting out the appropriate entry in /etc/inetd.conf. As a best practice, the CERT/CC recommends disabling any services that are not explicitly required. As noted above, it is important to consider the consequences of such a change in your environment.

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Caldera, Inc.

Caldera Open Unix and UnixWare are vulnerable. Caldera has released Security Advisory CSSA-2001-SCO.30 (URL wrapped):

ftp://stage.caldera.com/pub/security/openunix/
CSSA-2001-SCO.30/CSSA-2001-SCO.30.txt

Compaq Computer Corporation

Case ID SSRT0782U
Compaq has not been able to reproduce the problem identified in this advisory for any Compaq OS. However, with the information available, we are including a code change for Compaq's TRU64 UNIX that will further reduce any potential overflow vulnerability. This updated code will be announced when patches are available from the TRU64 UNIX FTP site and will be included in future releases of TRU64 UNIX. The TRU64 UNIX FTP patch site is at:

http://ftp.support.compaq.com/public/dunix/

To subscribe to automatically receive future NEW Security Advisories from the Compaq's Software Security Response Team via electronic mail, use your browser select the URL:

http://www.support.compaq.com/patches/mailing-list.shtml

Select "Security and Individual Notices" for immediate dispatch notifications directly to your mailbox.

To report new Security Vulnerabilities, send mail to:

security-ssrt@compaq.com

In April of 2002 Compaq released the following Security Bulletin (SSRTM541):

http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?
source=SRB0013W.xml&dt=11

http://ftp.support.compaq.com/patches/.new/html/SSRT-541.shtml

Cray Inc.

UNICOS, UNICOS/mk, and CrayTools are not vulnerable.

For AIX 4.3, the APAR is IY25436
For AIX 5.1, the APAR is IY25437

To receive the emergency fix, AIX SupportLine customers can call 1-800-CALL-AIX. The emergency fix ("CDE_dtspcd_efix.tar.Z") is posted for customer download at:

ftp://aix.software.ibm.com/aix/efixes/security/

This efix also contains the efix for another buffer overflow in libDtSvc.a (efix "CDE_libDtSvc_efix.tar.Z", found in the FTP site given above). Thus, customers need only download and install this efix ("CDE_dtspcd_efix.tar.Z") to apply the two patches.

The Open Group

The Open Group maintains source code for the Common Desktop Environment (CDE). The Open Group is investigating this issue, and source licensees of The Open Group's CDE product can contact desktop@opengroup.org for advice regarding this issue.

SGI

SGI has released the following documents:

SGI Security Advisory 20011107-01-P
ftp://patches.sgi.com/support/free/security/advisories/20011107-01-P
SGI Security Advisory 20020302-01-A
ftp://patches.sgi.com/support/free/security/advisories/20020302-01-A

Sun

Sun has released Security Bulletin #00214:

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/214

Sun has also published Sun Alert Notification 41764:

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=salert/41764

Xi Graphics

Xi Graphics DeXtop 2.1 is vulnerable. Further information and a patch are available at the following locations:

ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.txt

ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.tar.gz

Appendix B. - References

The CERT Coordination Center thanks Internet Security Systems (ISS) X-Force, who published an advisory on this issue.

Author: Art Manion

Revision History

November 12, 2001:  initial release, added workaround to disable vulnerable service
November 13, 2001:  updated vendor information for HP
November 15, 2001:  updated vendor information for IBM, Xi Graphics
November 16, 2001:  updated vendor information for IBM
November 30, 2001:  updated vendor information for SGI
December 17, 2001:  updated vendor information for IBM
January 10, 2002:  updated vendor information for Sun
April 3, 2002:  updated vendor information for SGI
May 30, 2002:  updated vendor information for Compaq

Space shortcuts

Child pages