SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vulnerability

Bugtraq ID:	8616
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 15 2003 12:00AM
Updated:	Sep 15 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Texonet <http://www.texonet.com/>.
Vulnerable:	SCO Open Server 5.0.7 SCO Open Server 5.0.6 SCO Open Server 5.0.5
Not Vulnerable:

SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vulnerability

It has been reported that SCO OpenServer Internet Manager 'mana' process is prone to an authentication bypass issue. The issue is reported to occur as a local user is able to export the REMOTE_ADDR environment variable and set its value to 127.0.0.1. This would cause the mana process to execute the file menu.mana with administrative privileges without proper authentication. Normally executing mana would require proper credentials.

Exploitation could lead to further attacks, including execution of arbitrary code (as described in BID 8618).

SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vulnerability

The following proof of concept was provided (which also exploits BID 8618):

• /data/vulnerabilities/exploits/mana-root.sh

SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vulnerability

Solution:
The vendor has released an advisory with fixes in order to address this issue. Please see the referenced advisory for more information.

SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vulnerability

References:

• Vendor Homepage (SCO)