-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
AA-97.08                        AUSCERT Advisory
                Solaris 2.x CDE sdtcm_convert vulnerability
                                24 February 1997

Last Revised: --

- ---------------------------------------------------------------------------
AUSCERT has received information that a vulnerability exists in the
Solaris 2.x Common Desktop Environment (CDE) sdtcm_convert utility.

This vulnerability may allow local users to gain root privileges.

Exploit information involving this vulnerability has been made publicly
available.

AUSCERT recommends that sites take the steps outlined in section 3 as soon
as possible.
- ---------------------------------------------------------------------------

1.  Description

    sdtcm_convert(1) is a calendar data conversion utility which converts
    between version 3 and version 4 calendar data formats.

    During the execution of sdtcm_convert, files are modified with root
    privileges in an insecure manner.  By manipulating the files that
    sdtcm_convert is accessing, local users may change the ownership of
    arbitrary files on the system.  This may be leveraged to gain
    root privileges.

    sdtcm_convert is part of the Solaris 2.x Common Desktop Environment
    (CDE) Applications package, SUNWdtdst.  Sites can determine whether
    the SUNWdtdst package is installed with the command:

	% pkginfo -l SUNWdtdst

    The long listing (-l) from pkginfo will also give the version of the
    CDE package installed.

    The default location for sdtcm_convert is /usr/dt/bin/sdtcm_convert.

2.  Impact

    Local users may be able to change the ownership of arbitrary files
    on the system.  This may be leveraged to gain root privileges.

3.  Workarounds/Solution

    Official vendor patches have been released by Sun Microsystems which
    address this vulnerability (Section 3.1).

    Until the patches recommended by Sun Microsystems can be applied,
    AUSCERT recommends that sites limit the possible exploitation of this
    vulnerability by immediately removing the setuid permissions as stated
    in Section 3.2.

3.1 Install vendor patches

    Sun Microsystems has released security patches which address the
    vulnerability described in this advisory.  AUSCERT recommends that
    sites apply these patches as soon as possible.

    Patches have been released for:

        CDE version       Patch             MD5
        ~~~~~~~~~~~       ~~~~~             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        1.0.1 sparc       103671-02.tar.Z   abb42a75b89c16e085d0f8811eeede10
        1.0.2 sparc       103670-02.tar.Z   e9f8f34deaaf215ff5f5b632bf0d45ea
        1.0.1 x86         103718-02.tar.Z   cebb82a95592392359f5206fe2a63ed1
        1.0.2 x86         103717-02.tar.Z   18fe28c03abdf118b647fd347261089e

    Sites with SunService Contracts may obtain these patches through
    their local SunSolve Online server.

    For sites without a SunService Contract, the above security patches
    may be retrieved from:

        ftp://sunsolve1.sun.com.au/pub/outgoing/

    Note that this site is currently the only public area where these patches
    are available.

3.2 Remove setuid permissions

    To prevent the exploitation of the vulnerability described in this
    advisory, AUSCERT recommends that the setuid permissions be removed
    from sdtcm_convert immediately.  As the sdtcm_convert program will no
    longer work for non-root users, it is recommended that the execute
    permissions also be removed.

    For example:

    # ls -l /usr/dt/bin/sdtcm_convert
    -r-sr-sr-x   1 root daemon 285700 Feb 24 12:20 /usr/dt/bin/sdtcm_convert

    # chmod 500 /usr/dt/bin/sdtcm_convert
    -r-x------   1 root daemon 285700 Feb 24 12:20 /usr/dt/bin/sdtcm_convert

4.  Additional measures

    Most Unix systems ship numerous programs which have setuid or setgid
    privileges.  Often the functionality supplied by these privileged
    programs is not required by many sites.  The large number of privileged
    programs that are shipped by default are to cater for all possible
    uses of the system.

    AUSCERT encourages sites to examine all the setuid/setgid programs
    and determine the necessity of each program.  If a program does not
    absolutely require the setuid/setgid privileges to operate (for
    example, it is only run by the root user),  the setuid/setgid
    privileges should be removed.  Furthermore, if a program is not
    required at your site, then all execute permissions should be removed.

    A sample command to find all setuid/setgid programs is (run as root):

       # find / ( -perm -4000 -o -perm -2000 ) -type f -exec ls -l {} ;

    It is AUSCERT's experience that many vulnerabilities are being
    discovered in setuid/setgid programs which are not necessary for the
    correct operation of most systems.  Sites can increase their security
    by removing unnecessary setuid/setgid programs.

    For example, the functionality provided by the sdtcm_convert program
    is not needed by many sites.  If sites had previously disabled
    sdtcm_convert, they would not have been vulnerable to this latest
    exploit.

- ---------------------------------------------------------------------------
AUSCERT thanks Marko Laakso (University of Oulu) for his initial report,
continued assistance, and technical expertise crucial in the production of
this advisory.  Thanks also to CERT/CC, DFN-CERT and Sun Microsystems for
their help in this matter.
- ---------------------------------------------------------------------------

The AUSCERT team have made every effort to ensure that the information
contained in this document is accurate.  However, the decision to use the
information described is the responsibility of each user or organisation.
The appropriateness of this document for an organisation or individual
system should be considered before application in conjunction with local
policies and procedures.  AUSCERT takes no responsibility for the
consequences of applying the contents of this document.

If you believe that your system has been compromised, contact AUSCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

AUSCERT is located at The University of Queensland within the Prentice
Centre.  AUSCERT is a full member of the Forum of Incident Response and
Security Teams (FIRST).

AUSCERT maintains an anonymous FTP service which is found on:
ftp://ftp.auscert.org.au/pub/.  This archive contains past SERT and AUSCERT
Advisories, and other computer security information.

AUSCERT also maintains a World Wide Web service which is found on:
http://www.auscert.org.au/.

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 4477
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AUSCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

Postal:
Australian Computer Emergency Response Team
Prentice Centre
Brisbane
Qld.  4072.
AUSTRALIA


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision History


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBMxG+fyh9+71yA2DNAQEjSwP/WdzzIz1abitnf+DSwPTCjCBVQAVNlsiG
N9uim1D+beFSAOOnZ2fqaXxmMXOEDeXpqlVUAWZNbJL7LkfpJPAnMU/8sZdLzY+U
SGQt0tV1JFsn5tCeTz+mCD/dgejdSnOYa3L2/65Sg/XXVLPWFc1N4jMVd8iAvK9i
pM6V1v4fcoY=
=mbcK
-----END PGP SIGNATURE-----