National Vulnerability Database (CVE-2002-0678)

National Cyber-Alert System Vulnerability Summary: CVE-2002-0678
Orirignal release date: 2002-07-23 Source: US-CERT/NIST ### Overview CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. ### Impact CVSS Severity: 7 (High) Range: local Authentication: input Impact Type: sec_prot admin="1" other="1" ### Reference to Advisories, Solutions, and Tools External Source: The Aims Group Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: CERT Name: CERT Advisory CA-2002-20 Multiple Vulnerabilities in CDE ToolTalk Hyperlink: http://www.cert.org/advisories/CA-2002-20.html External Source: CERT Name: Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file operations Hyperlink: http://www.kb.cert.org/vuls/id/299816 External Source: Security Focus Name: bid 5082 Hyperlink: http://online.securityfocus.com/bid/5082 ### Vulnerable Software and Vendor Tru64 (Compaq) AIX (IBM) OpenUnix (Caldera) HP-UX (HP) IRIX (SGI) Solaris (Sun) UnixWare (Caldera) DeXtop (Xi Graphics) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0678