DocView File Disclosure Vulnerability

Bugtraq ID:	8498
Class:	Input Validation Error
CVE:	CVE-2003-0658
Remote:	Yes
Local:	No
Published:	Aug 26 2003 12:00AM
Updated:	Jul 11 2009 11:56PM
Credit:	This vulnerability has been announced in a vendor security advisory.
Vulnerable:	SCO Unixware 7.1.3 Caldera OpenServer 5.0.7 Caldera OpenLinux Workstation 3.1.1 Caldera OpenLinux Server 3.1.1
Not Vulnerable:

DocView File Disclosure Vulnerability

docview has been reported prone to a remotely exploitable file disclosure vulnerability. It has been reported that remote attackers may exploit this condition, by invoking a malicious URL request against the affected docview utility, to disclose the contents of any publicly readable file.

DocView File Disclosure Vulnerability

Solution:
SCO have released an advisory (CSSA-2003-SCO.16) to address this issue for OpenServer systems. Please see the referenced advisory for further detail regarding applying relevant fixes.

SCO have released an advisory (CSSA-2003-SCO.18) to address this issue for UnixWare systems. Please see the referenced advisory for further detail regarding applying relevant fixes.

SCO have released an advisory (CSSA-2003-021.0) to address this issue for OpenLinux systems. Please see the referenced advisory for further detail regarding applying relevant fixes.


Caldera OpenLinux Server 3.1.1

• SCO docview-1.1-18.i386.rpm
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-023.0/R PMS/docview-1.1-18.i386.rpm

Caldera OpenLinux Workstation 3.1.1

• SCO docview-1.1-18.i386.rpm
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-02 3.0/RPMS/docview-1.1-18.i386.rpm

Caldera OpenServer 5.0.7

• SCO VOL.000.000
  ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2003-SCO.16/VOL.000. 000

SCO Unixware 7.1.3

• SCO erg712369.pkg.Z
  ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.18/erg712369.pkg. Z

DocView File Disclosure Vulnerability

References: