SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
BID:9025
Info
SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
| Bugtraq ID: | 9025 |
| Class: | Access Validation Error |
| CVE: |
CVE-2003-0937 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 12 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | Discovery of this vulnerability has been credited to Joel Soderberg and Christer Oberg from Texonet. |
| Vulnerable: |
SCO Unixware 7.1.3 SCO Unixware 7.1.1 SCO Open UNIX 8.0 |
| Not Vulnerable: | |
Discussion
SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
There exists a protection facility in procfs to prevent access to certain files in the procfs when setuid/setgid executables are run by an unprivileged user.
The SCO UnixWare/Open UNIX implementation of procfs has been reported prone to a vulnerability that will allow a local attacker to bypass procfs setuid/setgid 'as' file protection procedures.
A local attacker may exploit this vulnerability to elevate privileges on a vulnerable system.
There exists a protection facility in procfs to prevent access to certain files in the procfs when setuid/setgid executables are run by an unprivileged user.
The SCO UnixWare/Open UNIX implementation of procfs has been reported prone to a vulnerability that will allow a local attacker to bypass procfs setuid/setgid 'as' file protection procedures.
A local attacker may exploit this vulnerability to elevate privileges on a vulnerable system.
Exploit / POC
SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
Solution:
SCO have released an advisory (CSSA-2003-SCO.32) and fixes to address this issue. Users who are potentially affected by this vulnerability are advised to apply the relevant fixes as soon as possible. Further information regarding obtaining and applying appropriate fixes can be found in the referenced advisory.
SCO Unixware 7.1.1
SCO Unixware 7.1.3
SCO Open UNIX 8.0
Solution:
SCO have released an advisory (CSSA-2003-SCO.32) and fixes to address this issue. Users who are potentially affected by this vulnerability are advised to apply the relevant fixes as soon as possible. Further information regarding obtaining and applying appropriate fixes can be found in the referenced advisory.
SCO Unixware 7.1.1
-
SCO erg712482a.Z
ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.32/erg712482a.Z
SCO Unixware 7.1.3
-
SCO erg712482c.Z
ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.32/erg712482c.Z
SCO Open UNIX 8.0
-
SCO erg712482b.Z
ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.32/erg712482b.Z
References
SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerability
References:
References:
- Insecure handling of procfs descriptors in UnixWare 7.1.1, 7.1.3 and Open UNIX 8 ("advisories\(-at-\)texonet.com"