OpenServer crontab Format String Vulnerability

Bugtraq ID:	4938
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 04 2002 12:00AM
Updated:	Jun 04 2002 12:00AM
Credit:	Credited to KF <[email protected]>.
Vulnerable:	Caldera OpenServer 5.0.6 Caldera OpenServer 5.0.5
Not Vulnerable:

OpenServer crontab Format String Vulnerability

It has been reported that the OpenServer implementation of 'crontab' is vulnerable to a format string error. The condition occurs when crontab issues an error message as a result of an invalid filename argument. The filename argument supplied to crontab is passed directly to a 'printf()' function as the format string argument. This condition may be exploited by local attackers to overwrite memory in the address space of the crontab process.

OpenServer crontab Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenServer crontab Format String Vulnerability

Solution:
Updates are available:


Caldera OpenServer 5.0.5

• Caldera CSSA-2002-SCO.35
  ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.35

Caldera OpenServer 5.0.6

• Caldera CSSA-2002-SCO.35
  ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.35

OpenServer crontab Format String Vulnerability

References:

• Caldera Security Advisories Page (Caldera Systems)