Signature Detail

RPC: TT Malformed RPC Message Overflow

This signature detects attempts to exploit a known vulnerability against the ToolTalk rpc.ttdbserverd used in Common Desktop Environment (CDE) for Solaris, IRIX, HP-UX, and other platforms. The ToolTalk messaging server uses ttsession and RPC calls to enable communication between independent applications. Attackers can embed arbitrary commands in a maliciously crafted RPC message to cause the server to overflow an automatic variable on the stack, overwrite the activation records stored on the stack, and execute the embedded commands; attackers can gain complete control of server processes.

Extended Description

An implementation fault in the ToolTalk object database server allows a remote attacker to run arbitrary code as the superuser on hosts supporting the ToolTalk service. The affected program runs on many popular UNIX operating systems supporting CDE and some Open Windows installs. The ToolTalk service allows independently developed applications to communicate with each other by exchanging ToolTalk messages. Using ToolTalk, applications can create open protocols which allow different programs to be interchanged, and new programs to be plugged into the system with minimal reconfiguration. The ToolTalk database server (rpc.ttdbserverd) is an ONC RPC service which manages objects needed for the operation of the ToolTalk service. ToolTalk-enabled processes communicate with each other using RPC calls to this program, which runs on each ToolTalk-enabled host. This program is a standard component of the ToolTalk system, which ships as a standard component of many commercial Unix operating systems. The ToolTalk database server runs as root. Due to an implementation fault in rpc.ttdbserverd, it is possible for a malicious remote client to formulate an RPC message that will cause the server to overflow an automatic variable on the stack. By overwriting activation records stored on the stack, it is possible to force a transfer of control into arbitrary instructions provided by the attacker in the RPC message, and thus gain total control of the server process.

Affected Products

• HP HP-UX 10.10.0
• HP HP-UX 10.20.0
• HP HP-UX 10.30.0
• HP HP-UX 11.0.0
• IBM AIX 4.1.0
• IBM AIX 4.1.1
• IBM AIX 4.1.2
• IBM AIX 4.1.3
• IBM AIX 4.1.4
• IBM AIX 4.1.5
• IBM AIX 4.2.0
• IBM AIX 4.2.1
• IBM AIX 4.3.0
• SGI IRIX 5.2.0
• SGI IRIX 5.3.0
• SGI IRIX 5.3.0 XFS
• SGI IRIX 6.0.0
• SGI IRIX 6.0.1
• SGI IRIX 6.0.1 XFS
• SGI IRIX 6.1.0
• SGI IRIX 6.2.0
• SGI IRIX 6.3.0
• SGI IRIX 6.4.0
• Sun Solaris 1.1
• Sun Solaris 1.1.1
• Sun Solaris 1.1.2
• Sun Solaris 1.1.3
• Sun Solaris 1.1.3 U1
• Sun Solaris 1.1.4
• Sun Solaris 1.1.4-JL
• Sun Solaris 1.2
• Sun Solaris 2.0
• Sun Solaris 2.1
• Sun Solaris 2.2
• Sun Solaris 2.3
• Sun Solaris 2.4
• Sun Solaris 2.4_x86
• Sun Solaris 2.5
• Sun Solaris 2.5.1
• Sun Solaris 2.5.1_ppc
• Sun Solaris 2.5.1_x86
• Sun Solaris 2.5_x86
• Sun Solaris 2.6
• Sun Solaris 2.6_x86
• TriTeal TED CDE 4.3.0
• Xi Graphics Maximum CDE 1.2.3

References

• BugTraq: 122
• CVE: CVE-1999-0003
• URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0678
• URL: http://xforce.iss.net/xforce/xfdb/9526
• URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0677