Original issue date: January 21, 1998<BR>
Last revised: June 18, 1998<BR>
Minor editorial changes.
<P>A complete revision history is at the end of this file.
<P>The CERT Coordination Center has received reports of several
vulnerabilities in some implementations of the Common Desktop
Environment (CDE). The root cause of these vulnerabilities is that the
dtappgather program does not adequately check all information passed
to it by users. As a result, it is possible for a local user to gain
unauthorized privileged access or cause a denial of service on the
system.
<P>We recommend installing a vendor patch as soon as possible. Until you can do
so, we encourage you to disable vulnerable copies of the program.
<A HREF="#IIIa"> Section III.A.</A> of this advisory contains information on checking
for potentially vulnerable copies and disabling them. <A HREF="#IIIb">Section
III.B</A> and the <A HREF="#appen">appendix</A> contains vendor information.
<P>We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
<P><HR>
<H2>I. Description</H2>
There are several vulnerabilities in some implementations of the Common
Desktop Environment (CDE). The root cause of these vulnerabilities is
that the setuid root program "dtappgather" does not adequately check all
information passed to it by users. By exploiting these vulnerabilities,
an attacker can gain either unauthorized privileged access or cause a
denial of service on the system.
<H2>II. Impact</H2>
Local users are able to gain write access to arbitrary files. This can be
leveraged to gain privileged access.
<P>Local users may also be able to remove files from arbitrary directories,
thus causing a denial of service.
<H2>III. Solution</H2>
We recommend installing a vendor patch as soon as possible and disabling
the vulnerable program until you can do so. Instructions for determining
whether you have a potentially vulnerable version of this program are
given in Section A. Vendor patches are discussed in Section B.
<A NAME="IIIa"></A>
<OL>
<H2><LI TYPE="A">How to check for and disable potentially vulnerable versions of dtappgather</H2>
To find potentially vulnerable versions of dtappgather and to
disable those programs, use the following find(1) command or a
variant. Consult your local system documentation to determine how
to tailor the find(1) program on your system.
<P>You will need to run the find(1) command on each system you
maintain because the command examines files on local disks only.
Substitute the names of your local file systems for
FILE_SYSTEM_NAMES in the example. Example local file system names
are /, /usr, and /var. You should do this as root.
<P>Note that this is one long command, though we have separated
it onto three lines using backslashes.
<PRE>
find FILE_SYSTEM_NAMES -xdev -type f -user root \
-name 'dtappgather' -perm -04000 -exec ls -l '{}' \; \
-ok chmod u-s '{}' \;
</PRE>
<P> This command will find all files on a system that
<UL><LI> are only in the file systems you name (FILE_SYSTEM_NAMES -xdev)
<LI>are regular files (-type f)
<LI>are owned by root (-user root)
<LI>have the name "dtappgather" (-name 'dtappgather')
<LI>are setuid (-perm -04000)
</UL>
<P>Once found, those files will
<UL> <LI> have their names and details printed (-exec ls -l '{}')
<LI>no longer be setuid root, but only if you type `y' in
response to the prompt (-ok chmod u-s '{}' \;)</UL>
<P>Until you are able to install the appropriate patch, we recommend
that you remove the setuid bit from the dtappgather program. Note
that doing this will affect the functionality of the dtappgather
program for some users. For example, newly created users that have
not logged into the CDE desktop may not have any icons in the
Application Manager window; existing users may not notice any
change in functionality.
<A NAME="IIIb"></A>
<H2><LI> Obtain and install a patch for this problem.</H2>
If your vendor has a patch for this problem, we encourage you to
apply the patch as soon as possible.
<P>Appendix A contains a list of vendors who have provided information
about this problem. We will update the appendix as we receive more
information. If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact your vendor directly.
</OL>
<P>
<HR><A NAME="appen"></A>
<H2>Appendix A - Vendor Information</H2>
Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.
<H3>Digital Equipment Corporation</H3>
At the time of writing this document, patches(binary kits) are in
progress. Distribution of the fix for this problem is expected to begin
soon. Digital will provide notice of the completion/availability of the
patches through AES services (DIA, DSNlink FLASH) and be available from
your normal Digital Support channel.
<H3>Hewlett-Packard Company</H3>
This problem is addressed HP Security Bulletin 075. This bulletin can be
found at one of these URLs:
<P> (for US, Canada, Asia-Pacific, & Latin-America)<BR>
<A HREF="http://us-support.external.hp.com">http://us-support.external.hp.com</A>
<P>
(for Europe)<BR>
<A HREF="http://europe-support.external.hp.com">http://europe-support.external.hp.com</A>
<P>Security Bulletin 075: Security Vulnerability in CDE on HP-UX
<PRE>
PLATFORM: HP9000 Series 700/800s running CDE on:
HP-UX 10.10, HP-UX 10.20,
HP-UX 10.24 (VVOS),
HP-UX 11.00
SOLUTION: Apply one of:
PHSS_13723 HP-UX 10.10
PHSS_13724 HP-UX 10.20
PHSS_13725 HP-UX 10.30
PHSS_13772 HP-UX 10.24
PHSS_13406 HP-UX 11.00
</PRE>
<H3>IBM Corporation</H3>
The version of dtappgather shipped with AIX is vulnerable. The
following fixes are in progress:
<PRE>
AIX 3.2: not vulnerable; CDE not shipped in 3.2
AIX 4.1: IX73436
AIX 4.2: IX73437
AIX 4.3: IX73438
</PRE>
<P>To Order:
<P>APARs may be ordered using Electronic Fix Distribution (via FixDist)
or from the IBM Support Center. For more information on FixDist,
reference URL:
<P>
<A HREF="http://service.software.ibm.com/aixsupport/">http://service.software.ibm.com/aixsupport/</A>
<P>or send e-mail to<A HREF="mailto:aixserv@austin.ibm.com">aixserv@austin.ibm.com</A> with a subject of "FixDist".
<P>IBM and AIX are registered trademarks of International Business Machines
Corporation.
<H3>The Open Group</H3>
The Open Group is investigating this vulnerability, and if reproduced
will develop a solution and provide a patch for its CDE licensees.
<H3>Siemens-Nixdorf Informationssysteme AG</H3>
Siemens-Nixdorf provides the TED desktop by TriTeal Corporation as CDE
product. TED contains the vulnerable program "dtappgather". We informed
TriTeal about this.
<P>
Please note: First level support for the TED desktop is done by
Siemens-Nixdorf Informationssysteme.
<H3>Silicon Graphics, Inc.</H3>
Silicon Graphics provides only the third party TriTeal CDE product.
<P>Triteal Corporation provides all support on the SGI offered CDE product.
Customers requiring support on the SGI CDE product should contact TriTeal
Corporation at 1-800-874-8325, or email support@triteal.com.
<P>For other Silicon Graphics related security information, please see the
SGI Security Headquarters website located at:
<P><A HREF="http://www.sgi.com/Support/security/security.html">http://www.sgi.com/Support/security/security.html</A>
<H3>Sun Microsystems, Inc.</H3>
<PRE>
Sun has released the following patches:
Patch CDE version
105837-01 1.2
105838-01 1.2_x86
104498-02 1.02
104500-02 1.02_x86
104497-02 1.01
104499-02 1.01_x86
The above patches are available at:
http://sunsolve.sun.com/sunsolve/pubpatches.html
</PRE>
<p><!--#include virtual="/include/footer_nocopyright.html" --> </p>
<p>Copyright 1998 Carnegie Mellon University.</p>
<HR>
Revision History
<PRE>
June 18, 1998 Minor editorial changes.
Feb. 12, 1998 Added information for Siemens-Nixdorf Informationssysteme AG.
Jan. 29, 1998 Updated vendor information for Sun.
</PRE>
|