SCO OpenServer recon Buffer Overflow Vulnerability
BID:2560
Info
SCO OpenServer recon Buffer Overflow Vulnerability
| Bugtraq ID: | 2560 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 27 2001 12:00AM |
| Updated: | Mar 27 2001 12:00AM |
| Credit: | Reported to bugtraq by Secure Network Operations <[email protected]> on 27 Mar 2001 |
| Vulnerable: |
SCO Open Server 5.0.6 |
| Not Vulnerable: | |
Discussion
SCO OpenServer recon Buffer Overflow Vulnerability
SCO OpenServer 5.0.6 (and possibly earlier versions) ships with a suid 'bin' executable called 'recon'.
'recon' is used to buffer and forward escape sequences from a user's input to timing-sensitive applications.
'recon' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.
If properly exploited, this can yield user 'bin' privileges to the attacker.
SCO OpenServer 5.0.6 (and possibly earlier versions) ships with a suid 'bin' executable called 'recon'.
'recon' is used to buffer and forward escape sequences from a user's input to timing-sensitive applications.
'recon' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.
If properly exploited, this can yield user 'bin' privileges to the attacker.
Exploit / POC
SCO OpenServer recon Buffer Overflow Vulnerability
/opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'`
Memory fault - core dumped
/opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'`
Memory fault - core dumped
Solution / Fix
SCO OpenServer recon Buffer Overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.