6b32246d06
Marco Ivaldi <marco.ivaldi@mediaservice.net> has identified 3 vulnerabilities in CDE. Two of them could affect our CDE (open-source version), while the 3rd (sdtcm_convert) is Solaris specific. The two vulnerabilities, both of which affect dtsession could allow a local privilege escalation to root. A POC exists for Solaris. The POC will not function on our CDE for two main reasons: - the POC is Solaris specific - The overflowed variables in question are allocated on the heap, whereas in Solaris these variables are located on the stack. The first vulnerability allows an extra long palette name to be used to cause a crash via insufficient validation in SrvPalette.c:CheckMonitor(). The second, which has not yet been assigned a CERT CVE resides in SmCreateDirs.c:_DtCreateDtDirs() in libDtSvc. Due to insufficient bounds checking, a crash or corruption can be achieved by using a very long DISPLAY name. This one is considered difficult to exploit, and no POC code is available at this time. CDE 2.x code-bases are also listed as not vulnerable, however some work has been done anyway to do some proper bounds checking in this function. The following text portions are copied from the relevant advisories, which have not been released as of this writing. NOTE: Oracle CDE does NOT use CDE 2.3.0a or earlier as mentioned below. They are completely different code-bases): Regarding CVE-2020-2692: A buffer overflow in the CheckMonitor() function in the Common Desktop Environment 2.3.0a and earlier, as distributed with Oracle Solaris 10 1/13 (Update 11) and earlier, allows local users to gain root privileges via a long palette name passed to dtsession in a malicious .Xdefaults file. Note that Oracle Solaris CDE is based on the original CDE 1.x train, which is different from the CDE 2.x codebase that was later open sourced. Most notably, the vulnerable buffer in the Oracle Solaris CDE is stack-based, while in the open source version it is heap-based. Regarding the DtSvc bug, which does not currently have a CERT CVE: A difficult to exploit stack-based buffer overflow in the _DtCreateDtDirs() function in the Common Desktop Environment version distributed with Oracle Solaris 10 1/13 (Update 11) and earlier may allow local users to corrupt memory and potentially execute arbitrary code in order to escalate privileges via a long X11 display name. The vulnerable function is located in the libDtSvc library and can be reached by executing the setuid program dtsession. The open source version of CDE (based on the CDE 2.x codebase) is not affected. |
||
|---|---|---|
| .. | ||
| admin | ||
| config | ||
| contrib | ||
| databases | ||
| debian | ||
| doc | ||
| examples | ||
| historical | ||
| imports/motif | ||
| include | ||
| lib | ||
| programs | ||
| util | ||
| .gitignore | ||
| CONTRIBUTORS | ||
| COPYING | ||
| HISTORY | ||
| Imakefile | ||
| Makefile | ||
| README | ||
| copyright | ||
README
************************************* The Common Desktop Environment is released under the terms of the LGPL V.2 license. You may reuse and redistribute this code under the terms of this license. See the COPYING file for details. ************************************* Purpose of this release: This release of CDE under a new opensource license is numbered starting at version 2.2.0. ************************************ Downloading this release: CDE may be downloaded in source form from the Common Desktop Environment website: http://sourceforge.net/projects/cdesktopenv/ Or via git: git clone git://git.code.sf.net/p/cdesktopenv/code cdesktopenv-code The git repository will always be more up to date than the downloadable tarballs we make available, so if you have problems, please try the latest version from git master. ************************************ Installing this release: Complete build and installation instructions can be found on the CDE wiki: http://sourceforge.net/p/cdesktopenv/wiki/Home/ Please go there and read the appropriate section(s) for your OS (Linux or FreeBSD/OpenBSD/NetBSD currently). There are a variety of dependencies that must be met, as well as specific set up steps required to build. Do not expect to just type 'make' and have it actually work without meeting the prerequisites and following the correct steps as spelled out on the wiki. :) There are also a lot of other documents and information there that you might find useful. ************************************ Support: You can join the development mailing list here: https://lists.sourceforge.net/lists/listinfo/cdesktopenv-devel There is a CDE IRC channel on chat.freenode.net, channel #cde Bug reports and patches encouraged.