Make -lXinerama a dep on libDtXinerama so it doen't need to be
specified in Makefile.am files or in LIBS as it was being done
previously.
This still needs a little work, ideally Xinerama should be completely
optional and only enabled if present. But we can save that for
later.
Also, restructure some of the dependencies in the lib/tt binaries. We
will link with libtt (which will include libtirpc as a dependency),
and XTOOLLIB - all the right X11 stuff without needing to add it to
every OS. Removed several uneeded OS specializations ("if LINUX",
etc) as a result.
That was not fun. There were a variety of issues. It's needs
testing.
We use the new GENCPP for preprocessing the various scripts and config
files in config/
Removed PORT_NOFORK define in favor of autotools vfork availablility
checking. Use vfork if present.
Got rid of getenv/putenv definitions in favor of including correct
system headers.
Use FD_CLOEXEC in fcntl() call rather than hardcoded '1'.
Added -lm check to configure so dtwm will build.
Renamed internal round() function to wmround() to fix warning about
redefinition of builtin.
Fixed missing backslash in Makefile.am that prevented half the sources
from building.
At this stage, these certainly won't actually build yet.
Just fix up the relevent Makefile.am files so that autogen does not
emit errors and warnings for them.
Removed AIX/HPUX support in Makefile.am files. No point in
propogating that stuff when we've already removed much of that
unmaintained code from the codebase.
Commented out all of the Sun Pro stuff. Someone whos using that will
need to go through and fix it. This is mostly in dtmail and dthelp.
In fact, someone who does Solaris in general will need to go through
this stuff.
Next up, we'll replace any remaining 'if SUN' conditionals with 'if
SOLARIS' which is a more appropriate name and was already defined in
configure.ac.
Then we'll see about getting these new directories building.
This fixes a potentially exploitable buffer overrun in dtprintinfo.
This was brought to my attention based on a 0day exploit released for
Solaris CDE.
The exploit code does not work (or build) on linux, and the overrun is
in the heap rather than the stack as on Solaris, but it's easy to see
how this could be exploited.
The following is the content of the advisory:
8<-----------------------------------------------------------
@Mediaservice.net (Cybaze Group) Security Advisory #2019-01 (2019-05-07)
Title: Local privilege escalation via CDE dtprintinfo
Application: Common Desktop Environment 2.3.0 and earlier
Platforms: Oracle Solaris 10 1/13 (Update 11) and earlier
Description: A local attacker can gain root privileges by exploiting
a buffer overflow in CDE dtprintinfo
Author: Marco Ivaldi <marco.ivaldi@mediaservice.net>
Contributor: Dave Aitel <dave.aitel@cyxtera.com> (original discovery)
Vendor Status: <secalert_us@oracle.com> notified on 2019-05-05
<cdesktopenv-devel@lists.sourceforge.net> notified on 2019-05-05
CVE: The Common Vulnerabilities and Exposures project has not assigned
a name to this issue yet
References: https://lab.mediaservice.net/advisory/2019-01-cde-dtprintinfo.txthttps://github.com/0xdea/raptor_infiltrate19https://sourceforge.net/p/cdesktopenv/wiki/Home/https://www.oracle.com/technetwork/server-storage/solaris10/https://www.mediaservice.net/https://infiltratecon.com/
1. Abstract.
A buffer overflow in the DtPrinterAction::PrintActionExists() function in the
Common Desktop Environment 2.3.0 and earlier, as used in Oracle Solaris 10 1/13
(Update 11) and earlier, allows local users to gain root privileges via a long
printer name passed to dtprintinfo by a malicious lpstat program.
This is a 0day vulnerability demonstrated at #INFILTRATE19 on May 2nd, 2019 in
the talk "A bug's life: story of a Solaris 0day".
2. Example Attack Session.
bash-3.2$ cat /etc/release
Oracle Solaris 10 1/13 s10x_u11wos_24a X86
Copyright (c) 1983, 2013, Oracle and/or its affiliates. All rights reserved.
Assembled 17 January 2013
bash-3.2$ uname -a
SunOS nostalgia 5.10 Generic_147148-26 i86pc i386 i86pc
bash-3.2$ id
uid=54322(raptor) gid=1(other)
bash-3.2$ gcc raptor_dtprintname_intel.c -o raptor_dtprintname_intel -Wall
bash-3.2$ ./raptor_dtprintname_intel 192.168.1.1:0
raptor_dtprintname_intel.c - dtprintinfo 0day, Solaris/Intel
Copyright (c) 2004-2019 Marco Ivaldi <raptor@0xdeadbeef.info>
Using SI_PLATFORM : i86pc (5.10)
Using stack base : 0x8047fff
Using rwx_mem address : 0xfeffa004
Using sc address : 0x8047f60
Using strcpy() address : 0xfefe26a0
lpstat called with -v
lpstat called with -v
lpstat called with -d
uid=0(root) gid=1(other)
3. Affected Platforms.
All platforms shipping the Common Desktop Environment are potentially
affected. This includes:
* Oracle Solaris 10 1/13 (Update 11) and earlier [default installation]
According to the CDE Wiki, the following platforms are officially supported:
* All Official Ubuntu variants 12.04 - 18.04
* Debian 6, 7, 8, 9
* Fedora 17 at least
* Archlinux
* Red Hat
* Slackware 14.0
* OpenBSD
* NetBSD
* FreeBSD 9.2, 10.x, 11.x
* openSUSE Tumbleweed (gcc7)
* openSUSE Leap 4.2 (gcc4)
* SUSE 12 SP3 (gcc4)
* Solaris, OpenIndiana
4. Fix.
The upstream CDE maintainers have issued a patch for this vulnerability. Oracle
is investigating the issue via tracking# S1153109 and is expected to release a
fix for all affected-supported versions of Solaris via their quarterly Critical
Patch Update (CPU) program.
As a temporary workaround, it is possible to remove the setuid bit from the
dtprintinfo executable as follows:
bash-3.2# chmod -s /usr/dt/bin/dtprintinfo
5. Proof of Concept.
A working exploit for Oracle Solaris 10 1/13 (Update 11) Intel has been
developed as a proof of concept. Exploits for other Solaris versions and for
the SPARC architecture are also available. All exploits can be downloaded at:
https://github.com/0xdea/raptor_infiltrate19/https://github.com/0xdea/exploits/
8<-----------------------------------------------------------
dtcalc compiled with clang segfaulted when switched
to a different mode like Deg to Rad or Financial to
Scientific. Was reproducable at least under FreeBSD/AMD64.
Fixed now.
Docs (help and the dtinfo guides) are now always built using the
ISO8859-1 locale. To support UTF-8, our docbook needs to be updated
to something from this century, ideally this decade. In addition, a
conversion to XML would also be required as a result. So, until that
happens, use ISO8859-1 for docs.
However, other locale information, like message catalogs, resource
files, and the like are now converted to UTF-8.
All supported languages are now built by default on linux again.
Jon Trulson