Unixware Cron Command Line Buffer Overflow Vulnerability

Bugtraq ID:	2943
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 28 2001 12:00AM
Updated:	Jun 28 2001 12:00AM
Credit:	This vulnerability was submitted in a Caldera International, Inc. Security Advisory on June 27th, 2001.
Vulnerable:	Caldera UnixWare 7
Not Vulnerable:

Unixware Cron Command Line Buffer Overflow Vulnerability

Cron is a task scheduler for Unix systems.

Crontab is prone to a buffer overflow in handling of command line parameters. An attacker may take advantage of this by executing crontab with a malicious argument.

If successfully exploited, this vulnerability will surrender 'root' access to the remote attacker.

Unixware Cron Command Line Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Unixware Cron Command Line Buffer Overflow Vulnerability

Solution:
The vendor has supplied a fix for this issue. It can be installed with the following commands:

# uncompress /tmp/erg711714a.Z
# pkgadd -d /tmp/erg711714a


Caldera UnixWare 7

• Caldera Unixware 7 erg711714a.Z
  ftp://ftp.sco.com/pub/security/unixware/sr847406/

Unixware Cron Command Line Buffer Overflow Vulnerability

References: