SCO UnixWare su(1) Buffer Overflow Vulnerability
BID:826
Info
SCO UnixWare su(1) Buffer Overflow Vulnerability
| Bugtraq ID: | 826 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-1999-0845 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 25 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | The exploit posted to the Bugtraq mailing list for this vulnerability lists K2 ([email protected]) as the author and discoverer of this bug. It was posted to the Bugtraq mailing list on Nov 25 1999 . |
| Vulnerable: |
SCO Unixware 7.1.1 SCO Unixware 7.1 SCO Unixware 7.0.1 SCO Unixware 7.0 SCO Unixware 2.1 |
| Not Vulnerable: | |
Discussion
SCO UnixWare su(1) Buffer Overflow Vulnerability
Certain versions of Unixware ship with a version of su(1) which is vulnerable to a buffer overflow attack. This attack is possible because su(1) fails to sanity check user supplied data, in this instance a username supplied on the command line. Because su(1) is SUID root this attack may result in root privileges.
Certain versions of Unixware ship with a version of su(1) which is vulnerable to a buffer overflow attack. This attack is possible because su(1) fails to sanity check user supplied data, in this instance a username supplied on the command line. Because su(1) is SUID root this attack may result in root privileges.
Exploit / POC
SCO UnixWare su(1) Buffer Overflow Vulnerability
exploit available
exploit available
Solution / Fix
SCO UnixWare su(1) Buffer Overflow Vulnerability
Solution:
SCO is providing an interim patch to address this issue in the form of a System Security Enhancement (SSE) package.
SSE039 contains replacement binaries for each system type, and is available for Internet download via anonymous ftp, and from the SCOFORUM on Compuserve.
You can download the SSE package as follows:
Anonymous ftp (World Wide Web URL):
ftp://ftp.sco.COM/SSE/sse039.ltr (cover letter, ASCII text)
ftp://ftp.sco.COM/SSE/sse039.tar.Z (new binaries, compressed tar
file)
Compuserve:
GO SCOFORUM, and search Library 11 (SLS/SSE Files) for these
filenames:
SSE039.LTR (cover letter, ASCII text)
SSE039.TAZ (new binaries, compressed tar file)
Checksums (sum -r):
01787 3 sse039.ltr
53627 555 sse039.tar.Z
Solution:
SCO is providing an interim patch to address this issue in the form of a System Security Enhancement (SSE) package.
SSE039 contains replacement binaries for each system type, and is available for Internet download via anonymous ftp, and from the SCOFORUM on Compuserve.
You can download the SSE package as follows:
Anonymous ftp (World Wide Web URL):
ftp://ftp.sco.COM/SSE/sse039.ltr (cover letter, ASCII text)
ftp://ftp.sco.COM/SSE/sse039.tar.Z (new binaries, compressed tar
file)
Compuserve:
GO SCOFORUM, and search Library 11 (SLS/SSE Files) for these
filenames:
SSE039.LTR (cover letter, ASCII text)
SSE039.TAZ (new binaries, compressed tar file)
Checksums (sum -r):
01787 3 sse039.ltr
53627 555 sse039.tar.Z
References
SCO UnixWare su(1) Buffer Overflow Vulnerability
References:
References: