Security Update: [CSSA-2001-SCO.4] UnixWare: uucp utilities buffer overflows

• Previous message: sco-securityat_private: "Security Update: [CSSA-2001-SCO.3] UnixWare - cron buffer overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

To: bugtraqat_private security-announceat_private

___________________________________________________________________________

	    Caldera International, Inc. Security Advisory

Subject:		UnixWare - uucp utilities buffer overflows
Advisory number: 	CSSA-2001-SCO.4
Issue date: 		2001 June, 27
Cross reference:
___________________________________________________________________________



1. Problem Description

	The uucp utilities are vulnerable to command line argument
	buffer overflows. These could allow a process to execute
	arbitrary code, allowing a malicious user to gain elevated
	privileges.


2. Vulnerable Versions

	Operating System	Version		Affected Files
	------------------------------------------------------------------
	UnixWare 7		All		/usr/bin/uucp
						/usr/bin/uux
						/usr/lib/uucp/bnuconvert
						/usr/lib/uucp/uucico
						/usr/lib/uucp/uuxcmd
						/usr/lib/uucp/uuxqt


3. Workaround

	None.


4. UnixWare 7

  4.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/security/unixware/sr847405/


  4.2 Verification

	md5 checksums:
	
	e93266c02e2bd2f71b9675847fd9a7b5	erg711716a.Z


	md5 is available for download from

		ftp://ftp.sco.com/pub/security/tools/


  4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	# uncompress /tmp/erg711716a.Z
	# pkgadd -d /tmp/erg711716a


5. References

	http://www.calderasystems.com/support/security/index.html


6. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on our website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera International, Inc. products.

___________________________________________________________________________

• application/pgp-signature attachment: stored

• Next message: Deja User: "Active Web Classifieds failure to authenticate leads to arbitrary code execution"
• Previous message: sco-securityat_private: "Security Update: [CSSA-2001-SCO.3] UnixWare - cron buffer overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jun 28 2001 - 11:34:31 PDT