A local overflow exists in the Common Desktop Environment (CDE) dtmail program. dtmail fails to sanitize format string characters passed on the command line resulting in a heap overflow. With a specially crafted format string, an attacker can cause arbitrary code to be executed with the privledges of the mail group resulting in a loss of confidentiality, integrity, or availability.

Upgrade CDE with the latest patches referenced by the vendor, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s):

Remove the "set-group-ID" bit from dtmail(1X) by doing the following:
# chmod 0555 /usr/dt/bin/dtmail

• Security Tracker: 1011040
• Bugtraq ID: 11027
• Secunia Advisory ID: 12363 15303
• ISS X-Force ID: 17095
• CVE ID: 2004-0800 (see also: NVD)
• CERT VU: 928598
• Vendor URL: http://sun.com/
• Vendor Specific Solution URL: http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109613&rev=07
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109614&rev=07
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112810&rev=06
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=113870&rev=05
• Vendor Specific Advisory URL: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57627
  http://support.avaya.com/elmodocs2/security/ASA-2005-110_SUN-4-01-2005.pdf
• Other Advisory URL: http://www.idefense.com/application/poi/display?id=132&type=vulnerabilities
• CIAC Advisory: o-202

• iDefense Labs - iDefense Labs