Buffer Overflow in CDE Subprocess Control Service
Last revised: May 30, 2002
A complete revision history can be found at the end of this file.
- Systems running CDE
There is a remotely exploitable buffer overflow vulnerability in a library function used by the CDE Subprocess Control Service. This vulnerability could be used to crash the service or to execute arbitrary code with root privileges. This vulnerability is documented in VU#172583.
The Common Desktop Environment (CDE) is an integrated graphical user interface that runs on UNIX and Linux operating systems. The CDE Subprocess Control Service (dtspcd) is a network daemon that accepts requests from clients to execute commands and launch applications remotely. On systems running CDE, dtspcd is spawned by the Internet services daemon (typically inetd or xinetd) in response to a CDE client request. dtspcd is typically configured to run on port 6112/tcp with root privileges.For more information about CDE, see
There is a remotely exploitable buffer overflow vulnerability in a shared library that is used by dtspcd. During client negotiation, dtspcd accepts a length value and subsequent data from the client without performing adequate input validation. As a result, a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges.
This vulnerability was first reported to us in March 1999, and more recently by Internet Security Systems (ISS) X-Force. For more information, see
This vulnerability has been assigned the identifier CAN-2001-0803 by the Common Vulnerabilities and Exposures (CVE) group:
Many common UNIX systems ship with CDE installed and enabled by default. To determine if your system is configured to run dtspcd, check for the following entries (may be wrapped):
- dtspc 6112/tcp
- dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd
An attacker can execute arbitrary code with root privileges.
Apply a patchAppendix A contains information from vendors who have provided information for this advisory. We will update the appendix as we receive more information. If a vendor's name does not appear, then the CERT/CC did not hear from that vendor. Please contact your vendor directly.
Limit access to vulnerable service
Until patches are available and can be applied, you may wish to limit or block access to the Subprocess Control Service from untrusted networks such as the Internet. Using a firewall or other packet-filtering technology, block or restrict access to the port used by the Subprocess Control Service. As noted above, dtspcd is typically configured to listen on port 6112/tcp. It may be possible to use TCP Wrapper or a similar technology to provide improved access control and logging functionality for dtspcd connections. Keep in mind that blocking ports at a network perimeter does not protect the vulnerable service from the internal network. It is important to understand your network configuration and service requirements before deciding what changes are appropriate. TCP Wrapper is available from
Disable vulnerable service
You may wish to consider disabling dtspcd by commenting out the appropriate entry in /etc/inetd.conf. As a best practice, the CERT/CC recommends disabling any services that are not explicitly required. As noted above, it is important to consider the consequences of such a change in your environment.
This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.
Caldera Open Unix and UnixWare are vulnerable. Caldera has released Security Advisory CSSA-2001-SCO.30 (URL wrapped):
Case ID SSRT0782U
Compaq has not been able to reproduce the problem identified in this advisory for any Compaq OS. However, with the information available, we are including a code change for Compaq's TRU64 UNIX that will further reduce any potential overflow vulnerability. This updated code will be announced when patches are available from the TRU64 UNIX FTP site and will be included in future releases of TRU64 UNIX. The TRU64 UNIX FTP patch site is at:
UNICOS, UNICOS/mk, and CrayTools are not vulnerable.
- For AIX 4.3, the APAR is IY25436
- For AIX 5.1, the APAR is IY25437
This efix also contains the efix for another buffer overflow in libDtSvc.a (efix "CDE_libDtSvc_efix.tar.Z", found in the FTP site given above). Thus, customers need only download and install this efix ("CDE_dtspcd_efix.tar.Z") to apply the two patches.
The Open Group maintains source code for the Common Desktop Environment (CDE). The Open Group is investigating this issue, and source licensees of The Open Group's CDE product can contact firstname.lastname@example.org for advice regarding this issue.
SGI has released the following documents:
- SGI Security Advisory 20011107-01-P
- SGI Security Advisory 20020302-01-A
Sun has released Security Bulletin #00214:
Xi Graphics DeXtop 2.1 is vulnerable. Further information and a patch are available at the following locations:
- ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.txt ftp://ftp.xig.com/updates/dextop/2.1/DEX2100.012.tar.gz
Author: Art Manion
Copyright 2001 Carnegie Mellon University.
November 12, 2001: initial release, added workaround to disable vulnerable service November 13, 2001: updated vendor information for HP November 15, 2001: updated vendor information for IBM, Xi Graphics November 16, 2001: updated vendor information for IBM November 30, 2001: updated vendor information for SGI December 17, 2001: updated vendor information for IBM January 10, 2002: updated vendor information for Sun April 3, 2002: updated vendor information for SGI May 30, 2002: updated vendor information for Compaq