Posted on 08/12/2002 5:37:10 PM PDT by Bush2000
CERT: Flaw could allow root access in some Unix, Linux systems
A buffer overflow in the ToolTalk RPC database server used in the Common Desktop Environment (CDE) on systems from vendors such as Sun Microsystems Inc. and IBM could allow an attacker to run code with root privileges, according to a security alert released today by the CERT Coordination Center (CERT/CC). CDE is a graphical interface used on Unix and some Linux systems. The ToolTalk component of the software allows applications to communicate with each other across different platforms and hosts via remote procedure calls (RPC). The RPC database server manages those communications.
The vulnerability comes from a buffer overflow -- an attack in which the amount of memory assigned to an application or process is overrun, often with unpredictable results -- in the _TT_CREATE_FILE procedure in the ToolTalk RPC database server, according to CERT/CC. Based at Carnegie Mellon University in Pittsburgh, CERT/CC is a federally funded computer and network security organization that frequently coordinates the release and repair of software security holes.
By sending a specially crafted RPC message to the vulnerable component, an attacker could gain the ability to run code on the target system with the same privileges as the ToolTalk server, which are usually root, CERT/CC said. Even if an attacker wasn't able to run code, the attack would cause a denial of service, CERT/CC said.
CDE is included in software from IBM, Hewlett-Packard Co., Sun, Silicon Graphics Inc. and others. Users should check with their vendors on whether their systems are vulnerable and for patch status and availability.
More information about the vulnerability, including a list of affected software, work-arounds and patches, can be found in CERT/CC's advisory.
Every Unix distro has at least host.allow/host.deny and most have tcpwrappers. Thus I can build a Solaris server and put it on the Internet and restrict X apps and RPC calls to the local net or restict it to localhost only. This is built in and all modern Unixes restrict X apps to localhost out of the box anyway.
Under Solaris, this can be done without any third-party apps, but using a script like Titan is easier.
Also take note that on Solaris and HP-UX you at least can turn off the graphical front-end, which you cannot under Windows. Windows requires running the graphical interface whether the server needs it or not.
This flaw is serious and needs to be fixed, but the vast majority of sysadmins needn't panic, their systems aren't immediately at risk. Only those systems which have been set up to allow outside access to CDE processes are at risk.
Indeed, my custom Solaris install script only installs about 18 packages (depending on the type of machine) total. No CDE, no ToolTalk, no sound, nothing but the core OS, networking and storage. Anything else I add as needed.
It amazes me that there are still software packages for Solaris that "require" a full install as part of their system requirements. Generally it's only one or two packages that they need but they are too lazy to find out which ones.
Veritas, Oracle and even Checkpoint do this. I've found that Checkpoint Firewall-1 will install with only the 18 packages in my script. Veritas requires most of the external storage packages and Oracle requires about 30 packages.
I've never built a server with CDE on it, though I've built some specialized workstations that required it. Checkpoint's firewall manager and Cisco's NetRanger controller both need it, although that's only for the management front-ends. On the server side, neither one requires CDE.
The Microsofties will of course go overboard about this, since they can't seem to conceive of a server that doesn't run a graphical front-end.
I was just starting to like ya, then you post something moronic like this. See, (l)users, such as yourself on MS products, can't segregate yourself from your makers desktop, which is afterall, what were talking about right? Unless a middleware/vertical app builds in CLI's, MS is toast when it comes to CLI strengths at the OS level. At the core, you have to add on other app's to make the server even remotely close to a *nix strength when it comes to offering services. Don't call me a hypocrite. I don't like MS for a reason, It makes it harder for me to do my job (offering services to thousands of users). Now, when it comes to gaming, shit....let's go get some WC3 on with my XP box..
If only they'd written it in Java, none of this could have happened.
ObChuckle: rotflmao
Nein danke!
Nein danke!
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.