CVE-1999-0003

Description

Execute commands as root via buffer overflow in Tooltalk database server (rpc.ttdbserverd).

Affected products

• HP / hp-ux10.01 – 10.01
• HP / hp-ux11.00 – 11.00
• HP / hp-ux10.03 – 10.03
• HP / hp-ux10.02 – 10.02
• ibm / aix4.3 – 4.3
• ibm / aix4.1 – 4.1
• ibm / aix4.1.1 – 4.1.1
• ibm / aix4.1.2 – 4.1.2
• ibm / aix4.1.3 – 4.1.3
• ibm / aix4.1.4 – 4.1.4
• ibm / aix4.1.5 – 4.1.5
• ibm / aix4.2 – 4.2
• ibm / aix4.2.1 – 4.2.1
• sgi / irix6.2 – 6.2
• sgi / irix6.3 – 6.3
• sgi / irix6.4 – 6.4
• sgi / irix6.1 – 6.1
• sgi / irix6.0 – 6.0
• sgi / irix5.3 – 5.3
• sgi / irix5.2 – 5.2
• sun / solaris2.6 – 2.6
• sun / sunos5.5.1 – 5.5.1
• sun / sunos
• sun / sunos4.1.3 – 4.1.3
• sun / sunos5.0 – 5.0
• sun / sunos5.1 – 5.1
• sun / sunos5.2 – 5.2
• sun / sunos5.3 – 5.3
• sun / sunos5.4 – 5.4
• sun / sunos5.5 – 5.5
• tritreal / ted_cde4.3 – 4.3

Exploits & proofs of concept

• exploit-dbXi Graphics Maximum CDE 1.2.3/TriTeal TED CDE 4.3/Sun Solaris 2.5.1 - ToolTalk RPC Service Overflow (2)by NAI research team
• exploit-dbXi Graphics Maximum CDE 1.2.3/TriTeal TED CDE 4.3/Sun Solaris 2.5.1 - ToolTalk RPC Service Overflow (1)by NAI research team

References

• MISChttp://www.securityfocus.com/bid/122
• VENDOR_ADVISORYftp://patches.sgi.com/support/free/security/advisories/19981101-01-A
• VENDOR_ADVISORYftp://patches.sgi.com/support/free/security/advisories/19981101-01-PX