SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
BID:10758
Info
SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
| Bugtraq ID: | 10758 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0510 CVE-2004-0511 CVE-2004-0512 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 20 2004 12:00AM |
| Updated: | Jul 12 2009 06:16AM |
| Credit: | Discovery of the buffer overflow vulnerabilities is credited to the analysts at Deprotect. The individuals responsible for the discovery of the other issues are currently unknown; they were disclosed in the referenced vendor advisory. |
| Vulnerable: |
SCO MMDF |
| Not Vulnerable: | |
Discussion
SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
It has been reported that the SCO Multi-channel Memorandum Distribution Facility (MMDF) is affected by multiple vulnerabilities. These issues are due to a failure of the utility to properly validate buffer boundaries when copying user-supplied input.
These issues are known to be exploitable locally, however due to the nature of the application it is likely that remote exploitation is possible as well, although this is not confirmed.
An attacker might leverage these issues to execute arbitrary code in the context of the vulnerable utility; many of the affected utilities are setuid binaries by default. These issues might also be leveraged to cause the affected utility to crash, denying service to legitimate users.
It has been reported that the SCO Multi-channel Memorandum Distribution Facility (MMDF) is affected by multiple vulnerabilities. These issues are due to a failure of the utility to properly validate buffer boundaries when copying user-supplied input.
These issues are known to be exploitable locally, however due to the nature of the application it is likely that remote exploitation is possible as well, although this is not confirmed.
An attacker might leverage these issues to execute arbitrary code in the context of the vulnerable utility; many of the affected utilities are setuid binaries by default. These issues might also be leveraged to cause the affected utility to crash, denying service to legitimate users.
Exploit / POC
SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
The following exploit is made available by Ramon de Carvalho Valle <[email protected]>:
The following exploit is made available by Ramon de Carvalho Valle <[email protected]>:
Solution / Fix
SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
Solution:
SCO has released advisory SCOSA-2004.7 along with fixes dealing with this issue.
SCO MMDF
Solution:
SCO has released advisory SCOSA-2004.7 along with fixes dealing with this issue.
SCO MMDF
-
SCO VOL.000.000 (MMDF)
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.7/VOL.000.000
References
SCO Multi-channel Memorandum Distribution Facility Multiple Vulnerabilities
References:
References: