iDefense Security Advisory 02.24.06: SCO Unixware Setuid ptrace Local Privilege Escalation Vulnerability

SCO Unixware Setuid ptrace Local Privilege Escalation Vulnerability iDefense Security Advisory 02.24.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=395 February 24, 2006 I. BACKGROUND SCO Unixware is a Unix operating system that runs on many OEM platforms. More information...

CVE-2005-2934

CVE-2005-2934 describes a local privilege-escalation in SCO UnixWare 7.1.3 and 7.1.4 caused by a failure in the ptrace implementation to validate setuid permissions on traced binaries. This allows a local user to gain root privileges by attaching to a process via ptrace (exploitation described as...

CVE-2005-2934

Unspecified vulnerability in ptrace in SCO UnixWare 7.1.3 and 7.1.4 allows local users to gain privileges via unspecified vectors...

CVE-2006-0072

Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector...

Buffer overflow

Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector...

CVE-2006-0072

CVE-2006-0072 corresponds to a buffer overflow in SCO OpenServer 5.0.7's termsh component that can be exploited by a remote attacker via a long -o command line argument to execute arbitrary code. The vulnerability is distinct from CVE-2005-0351 and the connected sources reiterate the same affecte...

CVE-2006-0072

Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector...

SCO OpenServer 5.0.7 - termsh Local Privilege Escalation

SCO OpenServer 5.0.7 - termsh Local Privilege Escalation / SCO Openserver 5.0.7 termsh exploit =================================== 'termsh' is a program to view or modify an existing terminal entry on SCO Openserver. A stack based overflow exists in the handling of command line arguements, namely...

SCO Openserver 5.0.7 (termsh) Local Privilege Escalation Exploit

Exploit for sco platform in category local exploits ================================================================ SCO Openserver 5.0.7 termsh Local Privilege Escalation Exploit ================================================================ / SCO Openserver 5.0.7 termsh exploit...

SCO OpenServer 5.0.7 - 'termsh' Local Privilege Escalation

/ SCO Openserver 5.0.7 termsh exploit =================================== 'termsh' is a program to view or modify an existing terminal entry on SCO Openserver. A stack based overflow exists in the handling of command line arguements, namely the -o oadir arguement. It is installed setgid auth in a...

CVE-2005-2934

Unspecified vulnerability in ptrace in SCO UnixWare 7.1.3 and 7.1.4 allows local users to gain privileges via unspecified vectors...

CVE-2005-3903

Buffer overflow in uidadmin in SCO Unixware 7.1.3 and 7.1.4 allows local users to execute arbitrary code via a -S scheme argument that specifies a large file, a different vulnerability than CVE-2001-1063...

CVE-2005-3903

CVE-2005-3903 documents a local privilege escalation in SCO Unixware 7.1.3 and 7.1.4 caused by a buffer overflow in the setuid binary uidadmin when processing a long -S (scheme) argument that specifies a large file. The vulnerability arises from a failure to bound the input length, enabling a loc...

CVE-2005-3903

Buffer overflow in uidadmin in SCO Unixware 7.1.3 and 7.1.4 allows local users to execute arbitrary code via a -S scheme argument that specifies a large file, a different vulnerability than CVE-2001-1063...

SCO uidadmin buffer overflow

Buffer overflow on parsing -S command line parameter...

sco/x86 execve("/bin/sh", ..., NULL); 43 bytes

Exploit for sco/x86 platform in category shellcode ============================================== sco/x86 execve"/bin/sh", ..., NULL; 43 bytes ============================================== / minervini at neuralnoise dot com c 2005 SCOSV scosysv 3.2 5.0.7 i386, execve"/bin/sh", ..., NULL; / inclu...

SCO OpenServer RPC protocol DoS

RPC service hangs on invalid RPC BIND request...

CVE-2005-2926

Stack-based buffer overflow in 1 backupsh and 2 authsh in SCO Openserver 5.0.7 allows local users to execute arbitrary code via a long HOME environment variable...

CVE-2005-2927

Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the 1 prompt or 2 defprompt command...

CVE-2005-2927

CVE-2005-2927: Local buffer overflow in SCO UnixWare 7.1.3/7.1.4 (ppp prompt/defprompt) allows local users to run arbitrary code due to an unchecked long argument to the ppp binary (ppptalk) where the binary is setuid root. Vulnerable binaries include /usr/bin/ppptalk; impact is root privilege es...