SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   ToolTalk (rpc.ttdbserver) Vendors:   Caldera/SCO
(Caldera Issues Fix for Open UNIX/UnixWare) CDE ToolTalk Database Server Buffer Overflow in _TT_CREATE_FILE Procedure May Let Remote Users Execute Arbitrary Code With Root Privileges
SecurityTracker Alert ID:  1005097
SecurityTracker URL:  http://securitytracker.com/id/1005097
CVE Reference:   CVE-2002-0679   (Links to External Site)
Date:  Aug 21 2002
Impact:   Denial of service via network, Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A buffer overflow vulnerability was reported in the CDE ToolTalk database server. A remote user may be able to execute arbitrary code on the system, possibly with root level privileges.

Entercept Ricochet issued a security advisory warning of a buffer overflow in the _TT_CREATE_FILE procedure. According to the report, this results in a heap buffer overflow on most environments, allowing a remote user to execute arbitrary code with the privileges of the ToolTalk RPC database server or cause a denial of service condition on the server. It is reported that the server process typically runs as root.

The following vendors are reported to be affected:

- Caldera
- Compaq Computer Corporation
- Cray Inc.
- Data General
- Fujitsu
- Hewlett Packard
- IBM
- SGI
- Sun Microsystems Inc.
- The Open Group
- Xi Graphics

CERT has issued an advisory on the topic, available at:

http://www.cert.org/advisories/CA-2002-26.html

CERT has also issued a Vulnerability Note, available at:

http://www.kb.cert.org/vuls/id/387387

Impact:   A remote user may be able to execute arbitrary code on the system with the privileges of the server, which may be root privileges on some systems. A remote user can also cause denial of service conditions on the server.
Solution:   Caldera has released a fix for Open UNIX/UnixWare.

UnixWare 7.1.1:

Location of Fixed Binaries

ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28.1


Verification

MD5 (erg712073.pkg.Z) = c743fbce3e57a8dd07f417320ff5b3ab


Installing Fixed Binaries

Upgrade the affected binaries with the following commands:

Download erg712073.pkg.Z to the /var/spool/pkg directory

# uncompress /var/spool/pkg/erg712073.pkg.Z
# pkgadd -d /var/spool/pkg/erg712073.pkg


Open UNIX 8.0.0:

Location of Fixed Binaries

ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28.1


Verification

MD5 (erg712073.pkg.Z) = c743fbce3e57a8dd07f417320ff5b3ab


Installing Fixed Binaries

Upgrade the affected binaries with the following commands:

Download erg712073.pkg.Z to the /var/spool/pkg directory

# uncompress /var/spool/pkg/erg712073.pkg.Z
# pkgadd -d /var/spool/pkg/erg712073.pkg

Vendor URL:  www.caldera.com/support/security/index.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Open UNIX-SCO)
Underlying OS Comments:  Open UNIX 8.0.0; UnixWare 7.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Aug 12 2002 CDE ToolTalk Database Server Buffer Overflow in _TT_CREATE_FILE Procedure May Let Remote Users Execute Arbitrary Code With Root Privileges



 Source Message Contents

Subject:  Security Update: [CSSA-2002-SCO.28.1] UnixWare 7.1.1 Open UNIX 8.0.0 : REVISED: rpc.ttdbserverd file creation/deletion and


--IJpNTDwzlM2Ie8A6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca full-disclosure@lists.netsys.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		UnixWare 7.1.1 Open UNIX 8.0.0 : REVISED: rpc.ttdbserverd file creation/deletion and buffer overflow vulnerabilities
Advisory number: 	CSSA-2002-SCO.28.1
Issue date: 		2002 August 19
Cross reference:
______________________________________________________________________________


1. Problem Description

	Several security bugs were discovered in the rpc.ttdbserverd
	program that allow an attacker to overwrite memory in the
	program as well as force the program to create and delete
	arbitrary files on the system. Some of these vulnerabilities
	are remotely exploitable.

	This update adds a fix for an additional vulnerability: a
	buffer overflow described by CERT CA-2002-26.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	UnixWare 7.1.1			/usr/dt/bin/rpc.ttdbserverd
	Open UNIX 8.0.0 		/usr/dt/bin/rpc.ttdbserverd


3. Solution

	The proper solution is to install the latest packages.


4. UnixWare 7.1.1

	4.1 Location of Fixed Binaries

	ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28.1


	4.2 Verification

	MD5 (erg712073.pkg.Z) = c743fbce3e57a8dd07f417320ff5b3ab

	md5 is available for download from
		ftp://ftp.caldera.com/pub/security/tools


	4.3 Installing Fixed Binaries

		Upgrade the affected binaries with the following commands:

	Download erg712073.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg712073.pkg.Z
	# pkgadd -d /var/spool/pkg/erg712073.pkg


5. Open UNIX 8.0.0

	5.1 Location of Fixed Binaries

	ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28.1


	5.2 Verification

	MD5 (erg712073.pkg.Z) = c743fbce3e57a8dd07f417320ff5b3ab

	md5 is available for download from
		ftp://ftp.caldera.com/pub/security/tools


	5.3 Installing Fixed Binaries

		Upgrade the affected binaries with the following commands:

	Download erg712073.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg712073.pkg.Z
	# pkgadd -d /var/spool/pkg/erg712073.pkg


6. References

	Specific references for this advisory:

		CORE ST advisory CORE-20020528
		http://www.cert.org/advisories/CA-2002-20.html

		http://www.entercept.com/news/uspr/08-12-02.asp
		http://www.cert.org/advisories/CA-2002-26.html
		http://www.kb.cert.org/vuls/id/387387
		http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0679

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr865685, fz521202,
	erg712073.


7. Disclaimer

	Caldera International, Inc. is not responsible for the
	misuse of any of the information we provide on this website
	and/or through our security advisories. Our advisories are
	a service to our customers intended to promote secure
	installation and use of Caldera products.


8. Acknowledgements

	The file creation and deletion vulnerabilities were discovered
	and researched by Ricardo Quesada of the CORE IMPACT team at
	CORE Security Technologies. Sinan Eren of the Entercept
	Richochet Team reported the CA-2002-26 vulnerability.

______________________________________________________________________________

--IJpNTDwzlM2Ie8A6
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj1hcQoACgkQaqoBO7ipriGMZgCeKJYGT2OAX7+ox1FoX3XL8XDe
SWkAn233CvqEc3y6Jixk5X5JzlzJ+e5B
=4nRB
-----END PGP SIGNATURE-----

--IJpNTDwzlM2Ie8A6--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC