CERT® Advisory CA-1998-02 Vulnerabilities in CDEOriginal issue date: January 21, 1998
Last revised: June 18, 1998
Minor editorial changes.
A complete revision history is at the end of this file.
The CERT Coordination Center has received reports of several vulnerabilities in some implementations of the Common Desktop Environment (CDE). The root cause of these vulnerabilities is that the dtappgather program does not adequately check all information passed to it by users. As a result, it is possible for a local user to gain unauthorized privileged access or cause a denial of service on the system.
We recommend installing a vendor patch as soon as possible. Until you can do so, we encourage you to disable vulnerable copies of the program. Section III.A. of this advisory contains information on checking for potentially vulnerable copies and disabling them. Section III.B and the appendix contains vendor information.
We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.
I. DescriptionThere are several vulnerabilities in some implementations of the Common Desktop Environment (CDE). The root cause of these vulnerabilities is that the setuid root program "dtappgather" does not adequately check all information passed to it by users. By exploiting these vulnerabilities, an attacker can gain either unauthorized privileged access or cause a denial of service on the system.
II. ImpactLocal users are able to gain write access to arbitrary files. This can be leveraged to gain privileged access.
Local users may also be able to remove files from arbitrary directories, thus causing a denial of service.
III. SolutionWe recommend installing a vendor patch as soon as possible and disabling the vulnerable program until you can do so. Instructions for determining whether you have a potentially vulnerable version of this program are given in Section A. Vendor patches are discussed in Section B.
Appendix A - Vendor InformationBelow is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly.
Digital Equipment CorporationAt the time of writing this document, patches(binary kits) are in progress. Distribution of the fix for this problem is expected to begin soon. Digital will provide notice of the completion/availability of the patches through AES services (DIA, DSNlink FLASH) and be available from your normal Digital Support channel.
Hewlett-Packard CompanyThis problem is addressed HP Security Bulletin 075. This bulletin can be found at one of these URLs:
(for US, Canada, Asia-Pacific, & Latin-America)
Security Bulletin 075: Security Vulnerability in CDE on HP-UX
PLATFORM: HP9000 Series 700/800s running CDE on: HP-UX 10.10, HP-UX 10.20, HP-UX 10.24 (VVOS), HP-UX 11.00 SOLUTION: Apply one of: PHSS_13723 HP-UX 10.10 PHSS_13724 HP-UX 10.20 PHSS_13725 HP-UX 10.30 PHSS_13772 HP-UX 10.24 PHSS_13406 HP-UX 11.00
IBM CorporationThe version of dtappgather shipped with AIX is vulnerable. The following fixes are in progress:
AIX 3.2: not vulnerable; CDE not shipped in 3.2 AIX 4.1: IX73436 AIX 4.2: IX73437 AIX 4.3: IX73438
APARs may be ordered using Electronic Fix Distribution (via FixDist) or from the IBM Support Center. For more information on FixDist, reference URL:
or send e-mail firstname.lastname@example.org with a subject of "FixDist".
IBM and AIX are registered trademarks of International Business Machines Corporation.
The Open GroupThe Open Group is investigating this vulnerability, and if reproduced will develop a solution and provide a patch for its CDE licensees.
Siemens-Nixdorf Informationssysteme AGSiemens-Nixdorf provides the TED desktop by TriTeal Corporation as CDE product. TED contains the vulnerable program "dtappgather". We informed TriTeal about this.
Please note: First level support for the TED desktop is done by Siemens-Nixdorf Informationssysteme.
Silicon Graphics, Inc.Silicon Graphics provides only the third party TriTeal CDE product.
Triteal Corporation provides all support on the SGI offered CDE product. Customers requiring support on the SGI CDE product should contact TriTeal Corporation at 1-800-874-8325, or email email@example.com.
For other Silicon Graphics related security information, please see the SGI Security Headquarters website located at:
Sun Microsystems, Inc.
Sun has released the following patches: Patch CDE version 105837-01 1.2 105838-01 1.2_x86 104498-02 1.02 104500-02 1.02_x86 104497-02 1.01 104499-02 1.01_x86 The above patches are available at: http://sunsolve.sun.com/sunsolve/pubpatches.html
This document is available from: http://www.cert.org/advisories/CA-1998-02.html
CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.
We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Conditions for use, disclaimers, and sponsorship information
Copyright 1998 Carnegie Mellon University.
June 18, 1998 Minor editorial changes. Feb. 12, 1998 Added information for Siemens-Nixdorf Informationssysteme AG. Jan. 29, 1998 Updated vendor information for Sun.