SCO UnixWare PPP Prompt Local Buffer Overflow Vulnerability

Bugtraq ID:	15159
Class:	Boundary Condition Error
CVE:	CVE-2005-2927
Remote:	No
Local:	Yes
Published:	Oct 20 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Discovery is credited to iDEFENSE Labs.
Vulnerable:	SCO Unixware 7.1.4 SCO Unixware 7.1.3
Not Vulnerable:

SCO UnixWare PPP Prompt Local Buffer Overflow Vulnerability

SCO UnixWare is prone to a local buffer-overflow vulnerability.

The vulnerability presents itself when the application processes excessive data supplied through the Unixware point-to-point protocol (PPP) prompt.

UnixWare 7.1.4 and 7.1.3 are reported prone to this issue.

SCO UnixWare PPP Prompt Local Buffer Overflow Vulnerability


Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

SCO UnixWare PPP Prompt Local Buffer Overflow Vulnerability

Solution:
SCO has released advisory SCOSA-2005.41 to address this issue. Please see the referenced advisory for more information about obtaining and applying fixes.


SCO Unixware 7.1.3

• SCO SCOSA-2005.41
  UnixWare 7.1.3
  ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.41

SCO Unixware 7.1.4

• SCO SCOSA-2005.41
  UnixWare 7.1.4
  ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.41

SCO UnixWare PPP Prompt Local Buffer Overflow Vulnerability

References:

• SCO Unixware Setuid ppp prompt Buffer Overflow Vulnerability (iDEFENSE)
  
• Vendor Homepage (SCO)