2002 CERT Advisories CERT Division [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. http://www.sei.cmu.edu REV-03.18.2016.0 Copyright 2017 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The view, opinions, and/or findings contained in this material are those of the author(s) and should not be con- strued as an official Government position, policy, or decision, unless designated by other documentation. References herein to any specific commercial product, process, or service by trade name, trade mark, manu- facturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. This report was prepared for the SEI Administrative Agent AFLCMC/AZS 5 Eglin Street Hanscom AFB, MA 01731-2100 NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribu- tion. Please see Copyright notice for non-US Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or elec- tronic form without requesting formal permission. Permission is required for any other use. Requests for per- mission should be directed to the Software Engineering Institute at [email protected]. CERT® and CERT Coordination Center® are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM17-0052 2002 CERT ADVISORIES | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. Table of Contents CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service 1 CA-2002-02: Buffer Overflow in AOL ICQ 4 CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP) 7 CA-2002-04: Buffer Overflow in Microsoft Internet Explorer 114 CA-2002-05: Multiple Vulnerabilities in PHP fileupload 118 CA-2002-06: Vulnerabilities in Various Implementations of the RADIUS Protocol 121 CA-2002-07: Double Free Bug in zlib Compression Library 130 CA-2002-08: Multiple Vulnerabilities in Oracle Servers 140 CA-2002-09: Multiple Vulnerabilities in Microsoft IIS 147 CA-2002-10: Format String Vulnerability in rpc.rwalld 151 CA-2002-11: Heap Overflow in Cachefs Daemon (cachefsd) 154 CA-2002-12: Format String Vulnerability in ISC DHCPD 158 CA-2002-13: Buffer Overflow in Microsoft's MSN Chat ActiveX Control 163 CA-2002-14: Buffer overflow in Macromedia JRun 166 CA-2002-15: Denial-of-Service Vulnerability in ISC BIND 9 168 CA-2002-16: Multiple Vulnerabilities in Yahoo! Messenger 174 CA-2002-17: Apache Web Server Chunk Handling Vulnerability 178 CA-2002-18: OpenSSH Vulnerabilities in Challenge Response Handling 187 CA-2002-19: Buffer Overflows in Multiple DNS Resolver Libraries 198 CA-2002-20: Multiple Vulnerabilities in CDE ToolTalk 210 CA-2002-21: Vulnerability in PHP 217 CA-2002-22: Multiple Vulnerabilities in Microsoft SQL Server 222 CA-2002-23: Multiple Vulnerabilities In OpenSSL 229 CA-2002-24: Trojan Horse OpenSSH Distribution 236 CA-2002-25: Integer Overflow In XDR Library 240 CA-2002-26: Buffer Overflow in CDE ToolTalk 247 CA-2002-27: Apache/mod_ssl Worm 254 CA-2002-28: Trojan Horse Sendmail Distribution 261 CA-2002-29: Buffer Overflow in Kerberos Administration Daemon 265 2002 CERT ADVISORIES | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY i [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. CA-2002-30: Trojan Horse tcpdump and libpcap Distributions 272 CA-2002-31: Multiple Vulnerabilities in BIND 275 CA-2002-32: Backdoor in Alcatel OmniSwitch AOS 289 CA-2002-33: Heap Overflow Vulnerability in Microsoft Data Access Components (MDAC) 291 CA-2002-34: Buffer Overflow in Solaris X Window Font Service 294 CA-2002-35: Vulnerability in RaQ Server Appliances 299 CA-2002-36: CERT® Advisory CA-2002-36 Multiple Vulnerabilities in SSH Implementations 302 CA-2002-37: CERT® Advisory CA-2002-37 Buffer Overflow in Microsoft Windows Shell 310 2002 CERT ADVISORIES | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY ii [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. 1: CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service Original release date: January 14, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected . Systems running CDE Overview The CERT/CC has received credible reports of scanning and exploitation of Solaris systems run- ning the CDE Subprocess Control Service buffer overflow vulnerability identified in CA-2001-31 and discussed in VU#172583. I. Description Since CA-2001-31 was originally released last November, the CERT/CC has received reports of scanning for dtspcd (6112/tcp). Just recently, however, we have received credible reports of an exploit for Solaris systems. Using network traces provided by The Honeynet Project, we have confirmed that the dtspcd vulnerability identified in CA-2001-31 and discussed in VU#172583 is actively being exploited. The Common Desktop Environment (CDE) is an integrated graphical user interface that runs on UNIX and Linux operating systems. The CDE Subprocess Control Service (dtspcd) is a net- work daemon that accepts requests from clients to execute commands and launch applications re- motely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges. There is a remotely exploitable buffer overflow vulnerability in a shared library that is used by dtspcd. During client negotiation, dtspcd accepts a length value and subsequent data from the client without performing adequate input validation. As a result, a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges. The overflow occurs in a fixed-size 4K buffer that is exploited by the contents of one of the attack packets. The signature can be found at bytes 0x3e-0x41 in the following attack packet from a tcpdump log (lines may wrap): 09:46:04.378306 10.10.10.1.3592 > 10.10.10.2.6112: P 1:1449(1448) ack 1 win 16060 <nop,nop,timestamp 463986683 4158792> (DF) 2002 CERT ADVISORIES | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 1 [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. 1: CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service 0x0000 4500 05dc a1ac 4000 3006 241c 0a0a 0a01 [email protected].$..... 0x0010 0a0a 0a02 0e08 17e0 fee2 c115 5f66 192f ...f........_f./ 0x0020 8018 3ebc e1e9 0000 0101 080a 1ba7 dffb ..>............. 0x0030 003f 7548 3030 3030 3030 3032 3034 3130 .?uH000000020410 0x0040 3365 3030 3031 2020 3420 0000 0031 3000 3e0001..4....10. 0x0050 801c 4011 801c 4011 1080 0101 801c 4011 ..@...@.......@. 0x0060 801c 4011 801c 4011 801c 4011 801c 4011 ..@...@...@...@. ... The value 0x103e in the ASCII (right) column above is interpreted by the server as the number of bytes in the packet to copy into the internal 4K (0x1000) buffer. Since 0x103e is greater than 0x1000, the last 0x3e bytes of the packet will overwrite memory after the end of the 4K buffer. This is the same compromise vector identified in VU#172583. It is important to note that several Internet-enabled games may also use port 6112/tcp as a legiti- mate part of their normal operation, therefore, not all network activity involving this service may be malicious. Network administrators monitoring this type of activity may wish to verify whether probes of this type are actually attempts to exploit VU#172583. Many common UNIX systems ship with CDE installed and enabled by default. To determine if your system is configured to run dtspcd, check for the following entries (lines may wrap): in /etc/services dtspc 6112/tcp in /etc/inetd.conf dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd Any system that does not run the CDE Subprocess Control Service is not vulnerable to this prob- lem. II. Impact An attacker can execute arbitrary code with root privileges. III. Solution Apply a patch VU#172583 contains information from vendors who have provided information for this advisory. We will update the vulnerability note as we receive more information. If a vendor's name does not appear, then the CERT/CC did not hear from that vendor. Please contact your vendor directly. 2002 CERT ADVISORIES | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 2 [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. 1: CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service Vendor information can be found in the "Systems Affected" section of VU#172583 http://www.kb.cert.org/vuls/id/172583#systems Limit access to vulnerable service Until patches are available and can be applied, you may wish to limit or block access to the Sub- process Control Service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block or restrict access to the port used by the Subprocess Control Service.