Tooltalk Version

Updated 8/13/02
CVE 1999-0003
CVE 2001-0717
CAN 2002-0677
CVE 2002-0678
CVE 2002-0679

Impact

The database component of the ToolTalk service may be compromised, allowing malicious users to run arbitrary commands on a target system as a privileged user (typically Root).

Note: The red stoplight on this page indicates the highest possible severity level for this type of vulnerability. For the actual severity level in this case, refer to the colored dot beside the link to this tutorial on the previous page.

Background

The ToolTalk service allows independently developed applications to communicate with each other by exchanging ToolTalk messages. Using ToolTalk, applications are able to create open protocols that allow different programs to be interchanged. Also, ToolTalk makes it possible to plug new programs into a system with only minimal reconfigurations.

The main ToolTalk component, the ToolTalk database server, is an RPC service which manages objects needed for the operation of the ToolTalk service. All ToolTalk-enabled processes communicate with one another using RPC calls to this program, which runs on each ToolTalk-enabled host. The database server is a standard component of all ToolTalk systems, which itself ships as a standard component of many commercial UNIX operating systems.

The Problems

_TT_CREATE_FILE() Heap Buffer Overflow

8/13/02
CVE 2002-0679
The ToolTalk database server is vulnerable to a heap buffer overflow via an argument passed to the procedure _TT_CREATE_FILE(). With a specially crafted RPC message, an attacker with access to the ToolTalk RPC database service could exploit this vulnerability to execute arbitrary code or cause a denial of service. NOTE: The non-executable stack protection provided by some operating systems will not prevent the execution of code located on the heap. Systems affected by this vulnerability include Caldera Open UNIX 8 and UnixWare 7, IBM AIX releases 4.3.3 and 5.1.0, Solaris 2.5.1, 2.6, 7, 8, and 9, and Xi Graphics deXtop CDE versions prior to v3.0. Probably affected are HP-UX and HP Tru64 UNIX, IRIX 6.5 (and earlier).

_TT_ISCLOSE() Input Validation Problem

7/11/02
CAN 2002-0677
There is an input validation problem in the _TT_ISCLOSE() function in ToolTalk. This function, which is used to close a database upon a client's request, resets a memory address determined by a file descriptor specified by the client. The function does not check whether this file descriptor is within a valid range, thus allowing a remote attacker to set arbitrary memory locations to zero. Through various attacks, this capability could be leveraged to delete arbitrary files, create a denial of service, or possibly execute arbitrary commands.

CVE 2002-0678
A separate vulnerability in various ToolTalk functions could allow a local attacker to overwrite arbitrary files by creating symbolic links to the target files and then sending certain RPC requests.

Buffer Overflow Condition and Format String Problem

10/2/01
CVE 1999-0003
CVE 1999-0693
CVE 2001-0717
Three older potential vulnerabilities exist in the database server portion of the ToolTalk program. One is a remotely exploitable buffer overflow condition, one is a locally exploitable buffer overflow condition, and the other is a format string problem. All three flaws affect how the server processes RPC messages. By using a specially formulated RPC message, a malicious client might be able to gain control of the ToolTalk service (which usually runs as Root), and then issue arbitrary commands to the system as a privileged user. This means, of course, that the malicious user might be able to gain control of the target system and cause damage in the form of erased/modified system files, compromised information, etc.

Resolution

You should obtain and apply patches for the Tooltalk service, available from the vendor of your UNIX operating system. While most vendors have been contacted about these problems, some might not have a patch for the problem developed yet. Until patches are available, these vulnerabilities can be mitigated by using a firewall (or other packet-filtering technology) to block access to the ToolTalk RPC database server and possibly the RPC portmapper service from untrusted networks such as the Internet. Note, however, that blocking ports at a network perimeter does not protect the vulnerable service from attacks that originate from the internal network.

If ToolTalk is not required on your network, it may be best to completely disable it. This may be done by killing the rpc.ttdbserverd process and removing it from any OS startup scripts. You should carefully consider your network configuration and service requirements before deciding to restrict access to or disable the Tooltalk database or portmapper services.

Where can I read more about this?

For more information on the heap buffer overflow, read CERT Advisory 2002-26 and Vulnerability Note VU#387387. For more information about the input validation problem, see CERT Advisory 2002-20. For more information on the buffer overflow conditions, read CERT Advisory 1998-11, CIAC Bulletin I-091, and CERT Advisory 1999-11. For more information about the format string problem, see CERT Advisory 2001-27, Sun Security Bulletin 212, and Bugtraq. For detailed information on the ToolTalk program itself, visit HP/Compaq's ToolTalk FAQ.