SCO OpenServer Backupsh Local Buffer Overflow Vulnerability

Bugtraq ID:	15160
Class:	Boundary Condition Error
CVE:	CVE-2005-2926
Remote:	No
Local:	Yes
Published:	Oct 20 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Discovery is credited to iDEFENSE.
Vulnerable:	SCO Open Server 5.0.7
Not Vulnerable:

SCO OpenServer Backupsh Local Buffer Overflow Vulnerability

The 'backupsh' utility is prone to a local buffer-overflow vulnerability.

The vulnerability presents itself when the utility processes excessive data, which may corrupt process memory. The specific details about this issue are not currently available.

A successful attack allows arbitrary machine code execution with group backup privileges.

OpenServer 5.0.7 is reported prone to this issue.

The 'authsh' utility is also vulnerable to this issue; successful exploitation could result in an attacker gaining group auth privileges.

SCO OpenServer Backupsh Local Buffer Overflow Vulnerability


Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

SCO OpenServer Backupsh Local Buffer Overflow Vulnerability

Solution:
SCO has released advisory SCOSA-2005.41 to address this issue. Please see the referenced advisory for more information about obtaining and applying fixes.


SCO Open Server 5.0.7

• SCO SCOSA-2005.40
  OpenServer 5.0.7
  ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.40

SCO OpenServer Backupsh Local Buffer Overflow Vulnerability

References:

• SCO Openserver authsh 'Home' Buffer Overflow Vulnerability (iDEFENSE)
  
• SCO Openserver backupsh 'Home' Buffer Overflow Vulnerability (iDEFENSE)
  
• Vendor Homepage (SCO)