Notified: June 11, 2002 Updated: September 09, 2002
Affected
SOURCE: Compaq Computer Corporation, a wholly-owned subsidiary of Hewlett-Packard Company and Hewlett-Packard Company HP Services Software Security Response Team CROSS REFERENCE: SSRT2251 At this time Compaq does have solutions in final testing and will publish HP Tru64 UNIX security bulletin (SSRT2251) with patch information as soon as testing has completed and kits are available from the support ftp web site. A recommended workaround however is to disable rpc.ttdbserver until solutions are available. This should only create a potential problem for public software packages applications that use the RPC-based ToolTalk database server. This step should be evaluated against the risks identified, your security measures environment, and potential impact of other products that may use the ToolTalk database server. To disable rpc.ttdbserverd: Comment out the following line in /etc/inetd.conf: rpc.ttdbserverd stream tcp swait root /usr/dt/bin/rpc.ttdbserverd rpc.ttdbserverd Force inetd to re-read the configuration file by executing the inetd -h command. Note: The internet daemon should kill the currently running rpc.ttdbserver. If not, manually kill any existing rpc.ttdbserverd process.
The vendor has not provided us with any further information regarding this vulnerability.
Compaq (Hewlett-Packard) has released a security bulletin (SRB0039W/SSRT2251) that addresses VU#975403 and other vulnerabilities.
Notified: June 12, 2002 Updated: June 24, 2002
Unknown
Cray, Inc. does include ToolTalk within the CrayTools product. However, rpc.ttdbserverd is not turned on or used by any Cray provided application. Since a site may have turned this on for their own use, they can always remove the binary /opt/ctl/bin/rpc.ttdbserverd if they are concerned.
The vendor has not provided us with any further information regarding this vulnerability.
Given the history of CDE source code, it is likely that the CrayTools ToolTalk RPC database server is vulnerable.
Notified: June 12, 2002 Updated: June 13, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 12, 2002 Updated: July 11, 2002
Not Affected
Fujitsu's UXP/V operating system is not affected by the vulnerability reported in VU#975403 because UXP/V does not support any CDE functionalties.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 11, 2002 Updated: August 15, 2002
Affected
**REVISED 02** HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0207-199 Originally issued: 12 July 2002 Last revision: 14 Aug 2002 SSRT2274 Sec. Vulnerability in rpc.ttdbserver The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Buffer overflow in rpc.ttdbserver PLATFORM: HP9000 Series 700/800 running HP-UX releases 10.10, 10.20, 10.24, 11.00, 11.04, and 11.11. DAMAGE: Potential unauthorized access, increased privileges. SOLUTION: Until patches are available, manually install a replacement rpc.ttdbserver. MANUAL ACTIONS: Install replacement rpc.ttdbserver. AVAILABILITY: The replacement rpc.ttdbserver files are available now. CHANGE SUMMARY: Added CA-2002-26 information **REVISED 02** A. Background -->>Buffer overflows in rpc.ttdbserver has been reported by CERT -->>in CA-2002-20 and CA-2002-26. The potential exists to exploit -->>these overflows to gain unauthorized access. B. Recommended solution Until patches are available, install the appropriate file to replace rpc.ttdbserver. Note: The 10.20 file should be used for 10.24. The 11.00 file should be used for 11.04. On 10.24 and 11.04 (VVOS) rpc.ttdbserver is disabled by default. **REVISED 02** -->> 1. Download rpc.ttdbserver.2.tar.gz from the ftp site. This file is temporary and will be deleted when patches are available from the standard HP web sites, including itrc.hp.com. System: hprc.external.hp.com (192.170.19.51) Login: ttdb1 Password: ttdb1 FTP Access: ftp://ttdb1:ttdb1@hprc.external.hp.com/ or: ftp://ttdb1:ttdb1@192.170.19.51/ -->> file: rpc.ttdbserver.2.tar.gz Note: There is an ftp defect in IE5 that may result in a browser hang. To work around this: - Select Tools -> Internet Options -> Advanced - Un-check the option: [ ] Enable folder view for FTP sites **REVISED 02** -->> 2. Copy the rpc.ttdbserver.2.tar.gz file to a protected directory and unpack it. If you wish to verify the md5 sum before unpacking the rpc.ttdbserver.tar.gz file, please refer to: HPSBUX9408-016 Patch sums and the MD5 program -->> The md5 sum for rpc.ttdbserver.2.tar.gz is: -->> MD5 (rpc.ttdbserver.2.tar.gz) = -->> e6af458213a9834146f716c9df7f1aaf 3. Install the new rpc.ttdbserver file using the install_rpc.ttdbserver script or some similar procedure. The install_rpc.ttdbserver script is included in -->> rpc.ttdbserver.2.tar.gz. For example on a 10.20 system: ./install_rpc.ttdbserver rpc.ttdbserver.1020 4. The what(1) and cksum(1) outputs are: **REVISED 02** -->>$ what rpc.ttdbserver.1010 -->>rpc.ttdbserver.1010: -->> X Window System, Version 11 R5+ HP-UX B.10.10.020810 -O -->> (build date: Sat Aug 10 13:35:19 IST 2002) -->> rpc.ttdbserver: $Revision: 1.1 $ -->>$ cksum rpc.ttdbserver.1010 -->>2536143200 323584 rpc.ttdbserver.1010 -->>$ what rpc.ttdbserver.1020 -->>rpc.ttdbserver.1020: -->> X Window System, Version 11 R6+ HP-UX B.10.20.020810 +O2 -->> (build date: Sat Aug 10 12:56:54 IST 2002) -->> rpc.ttdbserver: $Revision: 1.1 $ -->>$ cksum rpc.ttdbserver.1020 -->>1981972883 323584 rpc.ttdbserver.1020 -->>$ what rpc.ttdbserver.1100 -->>rpc.ttdbserver.1100: -->> View: /view/venu_main, Build Type: r6hp700_1100 -->> hpcde2.1 -->> (build date: Fri Aug 9 10:49:13 IST 2002) -->> [rest deleted] -->>$ cksum rpc.ttdbserver.1100 -->>3680305777 327680 rpc.ttdbserver.1100 -->>$ what rpc.ttdbserver.1111 -->>rpc.ttdbserver.1111: -->> View: /view/venu_main, Build Type: r6hp700_1111 -->> hpcde2.1 -->> (build date: Fri Aug 9 11:37:48 IST 2002) -->> [rest deleted] -->>$ cksum rpc.ttdbserver.1111 -->>595997811 352256 rpc.ttdbserver.1111 C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP IT Resource Center via electronic mail, do the following: Use your browser to get to the HP IT Resource Center page at: http://itrc.hp.com Use the 'Login' tab at the left side of the screen to login using your ID and password. Use your existing login or the "Register" button at the left to create a login, in order to gain access to many areas of the ITRC. Remember to save the User ID assigned to you, and your password. In the left most frame select "Maintenance and Support". Under the "Notifications" section (near the bottom of the page), select "Support Information Digests". To -subscribe- to future HP Security Bulletins or other Technical Digests, click the check box (in the left column) for the appropriate digest and then click the "Update Subscriptions" button at the bottom of the page. or To -review- bulletins already released, select the link (in the middle column) for the appropriate digest. To -gain access- to the Security Patch Matrix, select the link for "The Security Bulletins Archive". (near the bottom of the page) Once in the archive the third link is to the current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. Security Patch Check completely automates the process of reviewing the patch matrix for 11.XX systems. For information on the Security Patch Check tool, see: http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/ displayProductInfo.pl?productNumber=B6834AA" The security patch matrix is also available via anonymous ftp: ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/ On the "Support Information Digest Main" page: click on the "HP Security Bulletin Archive". D. To report new security vulnerabilities, send email to security-alert@hp.com Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to security-alert@hp.com. Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes. Any other use of this information is prohibited. HP is not liable for any misuse of this information by any third party. -----End of Document ID: HPSBUX0207-199--------------------------------------
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 11, 2002 Updated: July 11, 2002
Affected
The CDE desktop product shipped with AIX is vulnerable to both the issues detailed above in the advisory. This affects AIX releases 4.3.3 and 5.1.0. An efix package will be available shortly from the IBM software ftp site. The efix packages can be downloaded from ftp.software.ibm.com/aix/efixes/security. This directory contains a README file that gives further details on the efix packages. The following APARs will be available in the near future: AIX 4.3.3: IY32368 AIX 5.1.0: IY32370
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 11, 2002 Updated: November 07, 2002
Affected
SGI acknowledges the ToolTalk vulnerabilities reported by CERT and is currently investigating. No further information is available at this time. For the protection of all our customers, SGI does not disclose, discuss or confirm vulnerabilities until a full investigation has occurred and any necessary patch(es) or release streams are available for all vulnerable and supported IRIX operating systems. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements. As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list on http://www.sgi.com/support/security/.
The vendor has not provided us with any further information regarding this vulnerability.
Please refer to SGI Security Advisories 20021101-01-P (CDE ToolTalk) and 20021102-01-P (IRIX ToolTalk).
Notified: June 11, 2002 Updated: July 10, 2002
Affected
The Solaris RPC-based ToolTalk database server, rpc.ttdbserverd, is vulnerable to the two vulnerabilities [VU#975403 VU#299816] described in this advisory in all currently supported versions of Solaris: Solaris 2.5.1, 2.6, 7, 8, and 9 Patches are being generated for all of the above releases. Sun will publish a Sun Security Bulletin and a Sun Alert for this issue. The Sun Alert will be available from: http://sunsolve.sun.com The patches will be available from: http://sunsolve.sun.com/securitypatch Sun Security Bulletins are available from: http://sunsolve.sun.com/security
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 12, 2002 Updated: July 11, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The Open Group maintains CDE code that is most likely vulnerable.
Notified: June 12, 2002 Updated: September 13, 2002
Affected
Caldera Open UNIX and Caldera UnixWare provide the CDE ttdbserverd daemon, and are vulnerable to these issues. Please see Caldera Security Advisory CSSA-2002-SCO.28 for more information. SCO OpenServer and Caldera OpenLinux do not provide CDE, and are therefore not vulnerable.
The vendor has not provided us with any further information regarding this vulnerability.
According to Caldera's investigation, UnixWare 7.1.1 and Open UNIX 8.0.0 appear vulnerable.
Updated: July 12, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
TriTeal went bankrupt in December 1999. It is possible that TriTeal Enterprise Desktop (TED) and CDE distributions based on TriTeal code are vulnerable.
Notified: June 12, 2002 Updated: June 13, 2002
Affected
Xi Graphics deXtop CDE v2.1 is vulnerable to this attack. A update correcting this issue will be available on our ftp site once this vulnerability has been publically announced. Most sites do not need to use the ToolTalk server daemon. Xi Graphics Security recommends that non-essential services are never enabled. To disable the ToolTalk server on your system, edit /etc/inetd.conf and comment out, or remove, the 'rpc.ttdbserver' line. Then, either restart inetd, or reboot your machine.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.