Upstream ksh has removed it's builtin aliases, favoring instead to make them
all builtin commands, this would also allow us to skip having to manually
merge another file, it was explained best in this email:
"Default aliases are an ugly hack that you are better off without.
Disadvantages include:
- 'unalias -a' becomes basically unusable as it gets rid of commands you
probably want;
- shell functions by those names are ignored (unless you quote their
names upon invocation);
- something like 'cmdname=foo; "$cmdname" bar baz' doesn't work if
$cmdname is an alias.
I strongly recommend removing the BLT_SPC flag from all of
your extra dtksh builtins. Making builtins "special builtins" is of no
real benefit at all, while introducing a pointless restriction: shell
functions by those names cannot be defined, which causes a risk of
incompatibility with scripts written for other shells. The BLT_SPC flag
is for a very few historic builtins that must have certain weird
corner-case behaviour of "special" builtins for POSIX compliance and
Bourne shell compatibility reasons."
Some of these functions were returning pointers cast as integers,
which of course is bad on a 64b LP64 systems.
This code should probably just be refactored at some point. There may
be other hidden issues, and all the casting just sucks.
This reverts commit 08b6281f60.
The Login manager is reponsible for setting the correct language
(LANG, etc) information before starting a CDE session.
This was supplied by Antonis Tsolomitis
<antonis.tsolomitis@gmail.com>, and allows you to hardcode a LANG
setting before starting up CDE, if your login manager does not do that
for you.
Marco Ivaldi <marco.ivaldi@mediaservice.net> has identified 3
vulnerabilities in CDE.
Two of them could affect our CDE (open-source version), while the 3rd
(sdtcm_convert) is Solaris specific.
The two vulnerabilities, both of which affect dtsession could allow a
local privilege escalation to root. A POC exists for Solaris. The
POC will not function on our CDE for two main reasons:
- the POC is Solaris specific
- The overflowed variables in question are allocated on the heap,
whereas in Solaris these variables are located on the stack.
The first vulnerability allows an extra long palette name to be used
to cause a crash via insufficient validation in
SrvPalette.c:CheckMonitor().
The second, which has not yet been assigned a CERT CVE resides in
SmCreateDirs.c:_DtCreateDtDirs() in libDtSvc. Due to insufficient
bounds checking, a crash or corruption can be achieved by using a very
long DISPLAY name.
This one is considered difficult to exploit, and no POC code is
available at this time. CDE 2.x code-bases are also listed as not
vulnerable, however some work has been done anyway to do some proper
bounds checking in this function.
The following text portions are copied from the relevant advisories,
which have not been released as of this writing.
NOTE: Oracle CDE does NOT use CDE 2.3.0a or earlier as mentioned
below. They are completely different code-bases):
Regarding CVE-2020-2692:
A buffer overflow in the CheckMonitor() function in the Common
Desktop Environment 2.3.0a and earlier, as distributed with Oracle
Solaris 10 1/13 (Update 11) and earlier, allows local users to gain
root privileges via a long palette name passed to dtsession in a
malicious .Xdefaults file.
Note that Oracle Solaris CDE is based on the original CDE 1.x train,
which is different from the CDE 2.x codebase that was later open
sourced. Most notably, the vulnerable buffer in the Oracle Solaris
CDE is stack-based, while in the open source version it is
heap-based.
Regarding the DtSvc bug, which does not currently have a CERT CVE:
A difficult to exploit stack-based buffer overflow in the
_DtCreateDtDirs() function in the Common Desktop Environment version
distributed with Oracle Solaris 10 1/13 (Update 11) and earlier may
allow local users to corrupt memory and potentially execute
arbitrary code in order to escalate privileges via a long X11
display name. The vulnerable function is located in the libDtSvc
library and can be reached by executing the setuid program
dtsession.
The open source version of CDE (based on the CDE 2.x codebase) is
not affected.
There was code (_DtSimpleError() and _DtSimpleErrornoError()) that
only used snprintf when USE_SNPRINTF was defined, which it never was
of course. We just remove the 2 checks and always use [v]snprintf.
For some reason, whenever OSMajorVersion was >= 2 (this equates to a
2.x kernel or above), yacc would be used instead of bison.
On Ubuntu, and probably other linux systems, yacc is just a shell
wrapper around bison, so let's just use that directly.
One-off error:
Old buffer length was 6 for one character (3 * 1 + 3)
We need one more byte par character in the buffer for
the hex representation of it.
+0 '"'
+1 '\\'
+2 'x'
+3 'f'
+4 'c'
+5 '"'
+6 0x0 << overflow
tcl combined with RCHECK will abort because memory blocks
are allocated contiguously and we overwrite the magic marker
of the next block.
