Arbitrary Command Execution in distcc
Summary
CVE-2004-2687: distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without... Affects distcc versions < 2.18.1-1. Fixed in 2.18.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
distcc is a distributed compiler that allows a user to distribute compilation of C, C++, Objective C, or Objective C++ code across several machines on a network. It is commonly used in development environments to speed up the compilation process. However, versions of distcc prior to 2.18.1-1 are vulnerable to arbitrary command execution when the server port is not properly restricted.
Vulnerability Detail
The vulnerability, identified as CVE-2004-2687, allows remote attackers to execute arbitrary commands by submitting compilation jobs to the distcc server without proper authorization checks. This means that an attacker can exploit this vulnerability to execute malicious code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Minimum fixed version
2.18.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade distccTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating distcc is not immediately feasible, a temporary workaround is to restrict access to the distcc server port manually. This can be done by configuring firewall rules or network access controls to only allow trusted IP addresses or networks to connect to the distcc server. By limiting access to the server, the risk of unauthorized command execution can be reduced.
Conclusion
The vulnerability in distcc allows remote attackers to execute arbitrary commands on the server, posing a significant security risk. It is crucial to update distcc to version 2.18.1-1 or later to mitigate this vulnerability. If immediate updating is not possible, restricting access to the distcc server port can provide temporary protection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for distcc →
FAQ
distcc is a distributed compiler that allows for faster compilation of code by distributing the compilation process across multiple machines on a network.
The vulnerability allows remote attackers to execute arbitrary commands on the distcc server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, update distcc to version 2.18.1-1 or later. This version includes the necessary fixes to restrict access to the server port and prevent unauthorized command execution.
If updating distcc is not immediately feasible, a temporary workaround is to restrict access to the distcc server port manually by configuring firewall rules or network access controls.
For more information about this vulnerability, you can refer to the CVE-2004-2687 entry in the National Vulnerability Database (NVD) or contact the distcc maintainers for further assistance.
Related vulnerabilities
Recent vulnerabilities recorded for distcc.
