SCO Unixware 7.1 - varmail Permissions

SCO Unixware 7.1 - varmail Permissions source: https://www.securityfocus.com/bid/849/info Certain versions of SCO's UnixWare only 7.1 was tested ship with the /var/mail/ directory with permission 777-rwxrwxrwx . This in effect allows malicious users to read incoming mail for users who do not yet...

SCO Unixware 7.1 - pkg Local Privilege Escalation

SCO Unixware 7.1 - pkg Local Privilege Escalation source: https://www.securityfocus.com/bid/850/info Certain versions of SCO's Unixware only version 7.1 was tested ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read a...

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which th...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'xauto' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/848/info Certain versions of SCO's UnixWare ship with a version of /usr/X/bin/xauto which is vulnerable to a buffer overflow attack which may result in an attacker gaining root privileges. This is exploitable to gain root privileges even though...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'coredump' Symlink

source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which they are calling. This is required because the...

SCO Unixware 7.1 - '/var/mail' Permissions

source: https://www.securityfocus.com/bid/849/info Certain versions of SCO's UnixWare only 7.1 was tested ship with the /var/mail/ directory with permission 777-rwxrwxrwx . This in effect allows malicious users to read incoming mail for users who do not yet have a mail file /var/mail/username...

SCO Unixware 7.1 - 'pkg' Local Privilege Escalation

source: https://www.securityfocus.com/bid/850/info Certain versions of SCO's Unixware only version 7.1 was tested ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permissi...

unixware7.uidadmin.txt

Greetings, OVERVIEW SCO UnixWare 7.1's sgid-sys /usr/bin/uidadmin will allow any user to gain root privileges as a result of it's ability to write ANY file, not just those traditionally writable by gid-sys. BACKGROUND All of my testing was done on UnixWare 7.1, no other versions have been tested...

CVE-1999-0845

Buffer overflow in SCO su program allows local users to gain root access via a long username...

SCO Unixware 7.0 - xlock(1) Username Local Buffer Overflow

SCO Unixware 7.0 - xlock1 Username Local Buffer Overflow // source: https://www.securityfocus.com/bid/825/info Certain versions of Unixware ship with a version of xlock which is vulnerable to a buffer overflow attack. The xlock1 program locks the local X display until a username and password are...

SCO Unixware 7.07.0.17.1 - Xsco Buffer Overflow

SCO Unixware 7.07.0.17.1 - Xsco Buffer Overflow // source: https://www.securityfocus.com/bid/824/info Under certain versions of Unixware, the SUID program Xsco is vulnerable to a buffer overflow attack. The problem lies in that Xsco does not sanity check user supplied data. // UnixWare7...

CVE-1999-1571

Buffer overflow in sar for SCO OpenServer 5.0.0 through 5.0.5 may allow local users to gain root privileges via a long -f parameter, a different vulnerability than CVE-1999-1570...

CVE-1999-0830

Buffer overflow in SCO UnixWare Xsco command via a long argument...

SCO Unixware 2.1/7.0/7.0.1/7.1/7.1.1 - su(1) Buffer Overflow

// source: https://www.securityfocus.com/bid/826/info Certain versions of Unixware ship with a version of su1 which is vulnerable to a buffer overflow attack. This attack is possible because su1 fails to sanity check user supplied data, in this instance a username supplied on the command line...

SCO_OpenServer_exploit.txt

Greetings, OK, I lied about being done with my OpenServer audit. I have a couple of these left over, mostly because they weren't root-compromises. There is an overflow in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel which will allow any user to gain lp privs. Note that this is NOT an...

CVE-1999-0893

userOsa in SCO OpenServer allows local users to corrupt files via a symlink attack...

PT-1999-1441 · Sco · Sco Openserver

Name of the Vulnerable Software and Affected Versions: SCO OpenServer affected versions not specified Description: The issue allows local users to corrupt files through a symlink attack, exploiting the userOsa in SCO OpenServer. Recommendations: At the moment, there is no information about a newe...

SCO Open Server 5.0.5 - userOsa Symlink

SCO Open Server 5.0.5 - userOsa Symlink source: https://www.securityfocus.com/bid/701/info Under certain versions of SCO OpenServer there exists a symlink vulnerability which can be exploited to overwrite any file which is group writable by the 'auth' group. The problem in particular is in the th...

SCO Open Server 5.0.5 - 'userOsa' Symlink

source: https://www.securityfocus.com/bid/701/info Under certain versions of SCO OpenServer there exists a symlink vulnerability which can be exploited to overwrite any file which is group writable by the 'auth' group. The problem in particular is in the the /etc/sysadm.d/bin/userOsa executable...

SCO Open Server 5.0.5 - cancel Buffer Overflow

SCO Open Server 5.0.5 - cancel Buffer Overflow // source: https://www.securityfocus.com/bid/702/info There is a buffer overflow vulnerability in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel. It is important to know that the overflows are not in "/usr/bin/cancel" or "/usr/lpd/remote/cancel...