#213 Addressing CA-1999-08
On the wiki's main page, there is a "Security Note" section mentioning that there are unresolved issues in the version of CDE this is based from. I want to investigate, and potentially fix, one of these: CA-1999-08.
This is a security issue with rpc.cmsd, which is the Calendar Manager Service daemon. Currently, this daemon is disabled, and thus when trying to run dtcm you get a lot of errors about the daemon not running. This is the safest option right now. The better option, obviously, is to actually identify and fix the issue in the first place, because a calendar program is very useful to have on a desktop environment.
The CERT Advisory does not give much information, though it does reference incident note IN-99-04, which... also doesn't say much about what the problem actually is. The old BUGTRAQ mailing list is mentioned in here, and after digging around the archives I did eventually find this posting from Aleph One which contains actual exploit code. I'm still de-crusting my C skills, but it looks like it is creating a calendar event that contains a buffer overflow?
This issue looks like it was only patched by downstream vendors rather than at the source by Open Group (why??), and unfortunately we don't legally have access to the source code for these versions. If anyone reading this worked at places like Sun, Hewlett-Packard, or SCO back in the day and know what the problem is and how it was addressed, PLEASE post a reply to this ticket with information. I would love to get this problem fixed and then look into what would be needed to solve ticket 212.
This was also assigned CVE-1999-0696 but that doesn't give any more detail. Sun also fixed CVE-1999-0320 but doesn't seem to have shared that with other vendors or The Open Group.
Unfortunately, many of the Sun records from that long ago are no longer accessible.
I can see in the SCCS history that the fixes for CVE-1999-0696 did involve buffer overflows, and that they didn't get all of them, as later fixes got more. (I was doing strcpy->strlcpy fixes as late as 2019 in the Solaris CDE.) Some of the fixes appear to be in code to make the server multi-threaded that I only see in Sun's fork, not the upstream code. There were also changes to code I see in upstream still, such as the send_hup() function in programs/dtcm/server/svcmain.c, to control the PATH/IFS/etc. variables that were used to execute the shell command there.
For CVE-1999-0320, the fixes involved avoiding race conditions, by doing things like switching from chmod/chown to fchmod/fchown.