Two vulnerabilities were discovered Wednesday in the Common Desktop
Environment (CDE) ToolTalk RPC database server that could allow hackers to
delete files or cause a denial-of-service (DoS) attack (define).
CDE is an integrated graphical user interface (define)
that runs on UNIX and Linux operating systems, and is widely installed as a
default program.
The ToolTalk service allows independently developed applications to
communicate with each other. Using ToolTalk, applications can create open
protocols that allow different programs to be interchanged, and new programs
to be plugged into the system with minimal reconfiguration.
The ToolTalk RPC database server manages communication between ToolTalk
applications. Sun, Hewlitt-Packard, Compaq, Caldera, IBM, and Xi Graphics
have all admitted to susceptibility on some on their machines.
The first vulnerability results from improper checks on user-supplied RPC
arguments. By issuing a specially crafted call to the procedure, a remote
attacker could overwrite certain locations in memory with zeros. Using a
combination of techniques, an attacker could delete any file that is
accessible by the ToolTalk RPC database server. Overwriting memory or
deleting files could cause a denial of service. It may also be possible to
execute arbitrary code and commands.
The second vulnerability stems from inadequate validation of file
operations. The ToolTalk RPC database server does not ensure that the target
of a file write operation is a valid file and not a symbolic link. This
could allow a hacker to overwrite any file with contents of his or her
choice, since the list of transaction records to log is passed by the client
program.
Despite the fact that no one is believed to have exploited the vulnerabilities
yet, Ivan Arce, CTO of Core Security Technologies, whose firm discovered the
vulnerability, believes the threat to be very serious.
“As far as we know it is not being exploited in the wild,” said Arce. “It
is very serious though because it effects almost every UNIX out there and it
provides remote privileged access. It’s in a service that shouldn’t be
accessed by untrusted parties — that could be a very bad situation.”
Vendors with vulnerable systems have provided patching information on their
security sites, as well as on the CERT Coordination
Center site. According to officials at CORE Security Services, if
patches are not yet available from a particular vendor, admins should block
access from untrusted networks to the ToolTalk Database server program and
disable the vulnerable service.
This is not the first instance of a security threat through a vulnerability
in the CDE. A vulnerability first discovered in November of last year was
reported to be widely
exploited on Solaris systems.
