These system can support PAM, but it requires a port of the NetBSD
module to do so. As a result, this support is disabled by default.
See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253073 for a
patch to add this support to the OS. Then you can set HasPamLibrary
to YES in the respective .cf files, rebuild CDE, and try it out.
Marco Ivaldi pointed me to some unsafe code in ParseJob.c. I do not
have a sun machine (well, not currently operational anyway), so the
code is not tested. But seriously, this is some horrible code. This
local parser for sun needs to be rewritten!
Some of these functions were returning pointers cast as integers,
which of course is bad on a 64b LP64 systems.
This code should probably just be refactored at some point. There may
be other hidden issues, and all the casting just sucks.
This reverts commit 08b6281f60.
The Login manager is reponsible for setting the correct language
(LANG, etc) information before starting a CDE session.
This was supplied by Antonis Tsolomitis
<antonis.tsolomitis@gmail.com>, and allows you to hardcode a LANG
setting before starting up CDE, if your login manager does not do that
for you.
Marco Ivaldi <marco.ivaldi@mediaservice.net> has identified 3
vulnerabilities in CDE.
Two of them could affect our CDE (open-source version), while the 3rd
(sdtcm_convert) is Solaris specific.
The two vulnerabilities, both of which affect dtsession could allow a
local privilege escalation to root. A POC exists for Solaris. The
POC will not function on our CDE for two main reasons:
- the POC is Solaris specific
- The overflowed variables in question are allocated on the heap,
whereas in Solaris these variables are located on the stack.
The first vulnerability allows an extra long palette name to be used
to cause a crash via insufficient validation in
SrvPalette.c:CheckMonitor().
The second, which has not yet been assigned a CERT CVE resides in
SmCreateDirs.c:_DtCreateDtDirs() in libDtSvc. Due to insufficient
bounds checking, a crash or corruption can be achieved by using a very
long DISPLAY name.
This one is considered difficult to exploit, and no POC code is
available at this time. CDE 2.x code-bases are also listed as not
vulnerable, however some work has been done anyway to do some proper
bounds checking in this function.
The following text portions are copied from the relevant advisories,
which have not been released as of this writing.
NOTE: Oracle CDE does NOT use CDE 2.3.0a or earlier as mentioned
below. They are completely different code-bases):
Regarding CVE-2020-2692:
A buffer overflow in the CheckMonitor() function in the Common
Desktop Environment 2.3.0a and earlier, as distributed with Oracle
Solaris 10 1/13 (Update 11) and earlier, allows local users to gain
root privileges via a long palette name passed to dtsession in a
malicious .Xdefaults file.
Note that Oracle Solaris CDE is based on the original CDE 1.x train,
which is different from the CDE 2.x codebase that was later open
sourced. Most notably, the vulnerable buffer in the Oracle Solaris
CDE is stack-based, while in the open source version it is
heap-based.
Regarding the DtSvc bug, which does not currently have a CERT CVE:
A difficult to exploit stack-based buffer overflow in the
_DtCreateDtDirs() function in the Common Desktop Environment version
distributed with Oracle Solaris 10 1/13 (Update 11) and earlier may
allow local users to corrupt memory and potentially execute
arbitrary code in order to escalate privileges via a long X11
display name. The vulnerable function is located in the libDtSvc
library and can be reached by executing the setuid program
dtsession.
The open source version of CDE (based on the CDE 2.x codebase) is
not affected.
There was code (_DtSimpleError() and _DtSimpleErrornoError()) that
only used snprintf when USE_SNPRINTF was defined, which it never was
of course. We just remove the 2 checks and always use [v]snprintf.
For some reason, whenever OSMajorVersion was >= 2 (this equates to a
2.x kernel or above), yacc would be used instead of bison.
On Ubuntu, and probably other linux systems, yacc is just a shell
wrapper around bison, so let's just use that directly.
This program should not be SUID root. If you need it's services, just
run
sudo dtprintinfo -populate
TODO: dtprintinfo should only create it's actions (if ever) in a
user's .dt/types/ directory and not in any system-wide dirs. No need
for root access at all.
This fixes a potentially exploitable buffer overrun in dtprintinfo.
This was brought to my attention based on a 0day exploit released for
Solaris CDE.
The exploit code does not work (or build) on linux, and the overrun is
in the heap rather than the stack as on Solaris, but it's easy to see
how this could be exploited.
The following is the content of the advisory:
8<-----------------------------------------------------------
@Mediaservice.net (Cybaze Group) Security Advisory #2019-01 (2019-05-07)
Title: Local privilege escalation via CDE dtprintinfo
Application: Common Desktop Environment 2.3.0 and earlier
Platforms: Oracle Solaris 10 1/13 (Update 11) and earlier
Description: A local attacker can gain root privileges by exploiting
a buffer overflow in CDE dtprintinfo
Author: Marco Ivaldi <marco.ivaldi@mediaservice.net>
Contributor: Dave Aitel <dave.aitel@cyxtera.com> (original discovery)
Vendor Status: <secalert_us@oracle.com> notified on 2019-05-05
<cdesktopenv-devel@lists.sourceforge.net> notified on 2019-05-05
CVE: The Common Vulnerabilities and Exposures project has not assigned
a name to this issue yet
References: https://lab.mediaservice.net/advisory/2019-01-cde-dtprintinfo.txthttps://github.com/0xdea/raptor_infiltrate19https://sourceforge.net/p/cdesktopenv/wiki/Home/https://www.oracle.com/technetwork/server-storage/solaris10/https://www.mediaservice.net/https://infiltratecon.com/
1. Abstract.
A buffer overflow in the DtPrinterAction::PrintActionExists() function in the
Common Desktop Environment 2.3.0 and earlier, as used in Oracle Solaris 10 1/13
(Update 11) and earlier, allows local users to gain root privileges via a long
printer name passed to dtprintinfo by a malicious lpstat program.
This is a 0day vulnerability demonstrated at #INFILTRATE19 on May 2nd, 2019 in
the talk "A bug's life: story of a Solaris 0day".
2. Example Attack Session.
bash-3.2$ cat /etc/release
Oracle Solaris 10 1/13 s10x_u11wos_24a X86
Copyright (c) 1983, 2013, Oracle and/or its affiliates. All rights reserved.
Assembled 17 January 2013
bash-3.2$ uname -a
SunOS nostalgia 5.10 Generic_147148-26 i86pc i386 i86pc
bash-3.2$ id
uid=54322(raptor) gid=1(other)
bash-3.2$ gcc raptor_dtprintname_intel.c -o raptor_dtprintname_intel -Wall
bash-3.2$ ./raptor_dtprintname_intel 192.168.1.1:0
raptor_dtprintname_intel.c - dtprintinfo 0day, Solaris/Intel
Copyright (c) 2004-2019 Marco Ivaldi <raptor@0xdeadbeef.info>
Using SI_PLATFORM : i86pc (5.10)
Using stack base : 0x8047fff
Using rwx_mem address : 0xfeffa004
Using sc address : 0x8047f60
Using strcpy() address : 0xfefe26a0
lpstat called with -v
lpstat called with -v
lpstat called with -d
uid=0(root) gid=1(other)
3. Affected Platforms.
All platforms shipping the Common Desktop Environment are potentially
affected. This includes:
* Oracle Solaris 10 1/13 (Update 11) and earlier [default installation]
According to the CDE Wiki, the following platforms are officially supported:
* All Official Ubuntu variants 12.04 - 18.04
* Debian 6, 7, 8, 9
* Fedora 17 at least
* Archlinux
* Red Hat
* Slackware 14.0
* OpenBSD
* NetBSD
* FreeBSD 9.2, 10.x, 11.x
* openSUSE Tumbleweed (gcc7)
* openSUSE Leap 4.2 (gcc4)
* SUSE 12 SP3 (gcc4)
* Solaris, OpenIndiana
4. Fix.
The upstream CDE maintainers have issued a patch for this vulnerability. Oracle
is investigating the issue via tracking# S1153109 and is expected to release a
fix for all affected-supported versions of Solaris via their quarterly Critical
Patch Update (CPU) program.
As a temporary workaround, it is possible to remove the setuid bit from the
dtprintinfo executable as follows:
bash-3.2# chmod -s /usr/dt/bin/dtprintinfo
5. Proof of Concept.
A working exploit for Oracle Solaris 10 1/13 (Update 11) Intel has been
developed as a proof of concept. Exploits for other Solaris versions and for
the SPARC architecture are also available. All exploits can be downloaded at:
https://github.com/0xdea/raptor_infiltrate19/https://github.com/0xdea/exploits/
8<-----------------------------------------------------------
For some reason, the #include of iconv.h was removed, and dummy stubs
were put in place on linux systems (only). This caused iconv() calls
to be completely ignored.
Now we use iconv() just like very other OS we support.
Localization seems to work. The main help viewer dies though. Other
parts of help seem to work. Index causes a crash too.
Crash:
*** Error in `/usr/dt/bin/dthelpview': malloc(): memory corruption (fast): 0x00000000021fefb0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f61814917e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82651)[0x7f618149c651]
/lib/x86_64-linux-gnu/libc.so.6(__libc_malloc+0x54)[0x7f618149e184]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0xc2ab)[0x7f617f71d2ab]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0x9ed1)[0x7f617f71aed1]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0xa31d)[0x7f617f71b31d]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(xcb_writev+0x45)[0x7f617f71b3a5]
/usr/lib/x86_64-linux-gnu/libX11.so.6(_XSend+0x19e)[0x7f6181b2a54e]
/usr/lib/x86_64-linux-gnu/libX11.so.6(_XReply+0x82)[0x7f6181b2aa42]
/usr/lib/x86_64-linux-gnu/libX11.so.6(XSync+0x4d)[0x7f6181b2652d]
/usr/lib/x86_64-linux-gnu/libXm.so.4(XmUpdateDisplay+0x49)[0x7f61821c1d89]
/usr/dt/lib/libDtHelp.so.2(+0x2cf1d)[0x7f6182ae8f1d]
/usr/dt/lib/libDtHelp.so.2(+0x2d66d)[0x7f6182ae966d]
/usr/dt/lib/libDtHelp.so.2(_DtHelpGlobSrchDisplayDialog+0x2205)[0x7f6182aebca5]
/usr/dt/lib/libDtHelp.so.2(_DtHelpDisplayIndexCB+0x26)[0x7f6182af07e6]
/usr/lib/x86_64-linux-gnu/libXm.so.4(+0xde9d5)[0x7f618216e9d5]
/usr/lib/x86_64-linux-gnu/libXm.so.4(+0xdf0c5)[0x7f618216f0c5]
/usr/lib/x86_64-linux-gnu/libXm.so.4(_XmDispatchGadgetInput+0x113)[0x7f6182140683]
/usr/lib/x86_64-linux-gnu/libXm.so.4(_XmGadgetActivate+0x22)[0x7f61821ef0b2]
/usr/lib/x86_64-linux-gnu/libXt.so.6(+0x48965)[0x7f6181e6f965]
/usr/lib/x86_64-linux-gnu/libXt.so.6(_XtTranslateEvent+0x31a)[0x7f6181e7090a]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtDispatchEventToWidget+0x4cb)[0x7f6181e4921b]
/usr/lib/x86_64-linux-gnu/libXt.so.6(+0x228dd)[0x7f6181e498dd]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtDispatchEvent+0xc9)[0x7f6181e499b9]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtAppProcessEvent+0x1d7)[0x7f6181e555d7]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtAppMainLoop+0x2d)[0x7f6181e49d9d]
/usr/dt/bin/dthelpview[0x401b77]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f618143a830]
/usr/dt/bin/dthelpview[0x401c89]
Docs (help and the dtinfo guides) are now always built using the
ISO8859-1 locale. To support UTF-8, our docbook needs to be updated
to something from this century, ideally this decade. In addition, a
conversion to XML would also be required as a result. So, until that
happens, use ISO8859-1 for docs.
However, other locale information, like message catalogs, resource
files, and the like are now converted to UTF-8.
All supported languages are now built by default on linux again.
In this commit, we convert FreeBSD and OpenBSD to use a system version
of TCL (8.6).
We also get rid of the hairy and buggy "CompareI18NStrings" custom Tcl
function and use the newer Tcl's builtin dictionary sort mechanism for
generating the Indexes and Glossaries, which were silently broken in
previous commits.
It was just not possible to use the same Tcl code in modern versions
of Tcl in addition to the ancient version included with CDE - so, now
we will always depend on the system version. It's been tested with
8.6 and 8.7 versions of Tcl with great results.
dtdocbook/instant has been modified to use a more modern Tcl (8.6),
which means certain functions are not present when we are using the
dtdocbook/tcl (7.5) version of tcl instead of a modern system version.
So, create some defines that should work around this problem.
One issue that came up was attempting to read array values indexed by
a key that didn't exist when generating indexes and glossaries.
I am not sure why this hasn't been a problem before, but for now, we
simply won't try to emit array values for non-existant array indexes.
Remove calls to bogus utility functions in cases where the user is
root and the filesystem in question is an NFS filesystem.
For now, __linux___ and CSRG_BASED machines will use statfs to
determine whether to test delete-ability. For other systems, just do
the create/delete test always if the user is root.
In addition:
- moved video type detection into a separate file: videoTypes.dt out
of datatypes.dt. Also, removed all actions from Antonis' dt files,
as these are handled by the new actions (listed below).
Image, postscript, and PDF types definitions are still located in
datatypes.dt.src
- supports most image files, PDFs, postscript files, and video files
via dtapp now.
- Added new actions:
- DisplayImage
- DisplayVideo
- DisplayPDF
- DisplayPS
All of these call the dtapp_* helpers to locate an appropriate
program to handle the task.
- Added a camera icon
- standardized the icons used to display the various types - all
images use the Dtimage icon now, as an example.
- moved the new *.dt files to their proper place in programs/types,
rather than programs/localized/C/types (my bad).
Please add any further video types into videoTypes.dt, and everything
else (for now) into datatypes.dt.
In the future, we should probably separate these out into
type-specific .dt files. Also, something should be done about playing
audio files too (maybe DisplayVideo.dt can handle all those too?)
This script is located in /usr/dt/bin/dtapp, and is then symlinked to
various helpers that can be used in DT actions to run programs.
The various helpers currently installed are:
dtapp_vimage - view an image file, override with DTAPP_VIMAGE.
Defaults to xv, display, and gimp, in that order.
dtapp_vpdf - view a PDF file, override with DTAPP_VPDF. Defaults to
okular, xpdf
dtapp_vps - view a postscript file, override with DTAPP_VPS. Defaults
to mgv, gv
dtapp_vvideo - view a video file, override with DTAPP_VVIDEO.
Defaults to vlc, ffplay.
When a request is made to view one of these files, the list of viewers
will be tried, in order, until one is found. If none are found, an
error message will be displayed. Add overrides to your ~/.dtprofile
file.
We can add more dtapp commands and defaults for them as needed.
This is in preparation for integrating Antonis Tsolomitis' extended
actions and icon files, coming up in future commits.
With earlier versions of RPC and TIRPC it seems that svctcp_create()
calles listen() on the socket (as seen by debugger and strace).
Tooltalk expects this behavior.
However, with newer systems (ArchLinux 5/18+ and similar bleeding edge
versions of SuSE's equivalent: Tumbleweed), this behavior seems to
have changed.
ttsession goes into an infinite loop trying to accept() a connection
in the TIRPC library (via svc_getreqset()).
It appears listen() is no longer called on the socket when it is
created via svctcp_create(). The hack in this commit, always causes
listen() to be called on the socket, and seems to resolve the problem.
But it is a hack I think. I don't know if this is the correct
behavior of svctcp_create() or we were just lucky before.
There were a variety of potential 64b problems due to the complete
lack of prototype declarations. So, we add a file, isam_prototypes.h,
generated mostly by the 'cproto' tool.
We also fixed up some errors that having proper prototypes pointed
out, mainly in passing ints where pointers were expected and vice
versa. The iserase() function was supposed to accept a char *, but
was defined as only accepting a char. Fun stuff like that.
This program has never worked very well, and it may still not work
very well. This commit removes the ancient C++ headers and uses
modern replacements with some changes required due to the different
interfaces.
It builds a lot cleaner, and no longer does stupid things like
deleteing char *, ostream.str()'s, and the like.
This program could be really useful if it worked well. Some thought
should be givien in the future to decouple this SW from dtappbuilder
and maybe just rewrite from scratch.
Jon Trulson