BID:4985

Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability

Info

Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability

Bugtraq ID:	4985
Class:	Boundary Condition Error
CVE:	CVE-2002-0158
Remote:	No
Local:	Yes
Published:	Jun 11 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Vulnerability discovery credited to KF <[email protected]>.
Vulnerable:	SCO Open Server 5.0.7 SCO Open Server 5.0.6 SCO Open Server 5.0.5 SCO Open Server 5.0.4 SCO Open Server 5.0.3 SCO Open Server 5.0.2 SCO Open Server 5.0.1 SCO Open Server 5.0

Not Vulnerable:

Discussion

Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability

OpenServer is commercial Unix operating system originally developed by SCO, and distributed by Caldera.

It may be possible for a local user to gain elevated privileges. When Xsco is executed, and an excessively long argument is supplied to the -co flag, a heap overflow occurs. This problem could allow a local user to supply a maliciously formatted string with the -co option that could result in the execution of arbitrary code, and elevated privileges.

Exploit / POC

Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability

The following proof of concept has been made available:

./Xsco :1 -co `perl -e 'print "A" x 9000'`

Solution / Fix

Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability

Solution:
SCO has released advisory CSSA-2003-SCO.26 to address this issue.

SCO Open Server 5.0