CERT-In Vulnerability Note
CIVN-2005-0107
SCO OpenServer authsh and backupsh buffer overflow vulnerability
Original Issue Date:October 28, 2005
Severity Rating: MEDIUM
Systems Affected
SCO OpenServer 5.0.7 and earlier
Overview
A buffer overflow vulnerability has been reported in authsh and backupsh utilities of SCO OpenServer which could be used by the local users to gain root privileges on the system.
Description
The binary utilities authsh and backupsh are distributed with SCO OpenServer platform. It is observed that the binary utilities authsh and backupsh are vulnerable to a stack based buffer overflow because of lack of bounds checking on the value given to the "HOME" environment variable.
This vulnerability could be exploited by local users, by supplying a specially crafted string to overflow a stack buffer and execute arbitrary code with group auth privileges authsh or with group backup privileges backupsh .
Workaround
- Remove the setgid bit from the authsh binary
# chmod g-s /opt/K/SCO/Unix/5.0.7Hw/usr/lib/sysadm/authsh
- Remove the setgid bit from the backupsh binary
# chmod g-s /opt/K/SCO/Unix/5.0.7Hw/usr/lib/sysadm/ backupsh
Solution
Update to the latest version
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.40
Vendor Information
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.40/SCOSA-2005.40.txt
References
Secunia
http://secunia.com/advisories/17274/
SecurityTracker
http://securitytracker.com/alerts/2005/Oct/1015099.html
iDefense
http://www.idefense.com/application/poi/display?id= 327&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=328&type=vulnerabilities
CVE Name
CAN-2005-2926
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|