SCO Open Server 5.0.5 - cancel Buffer Overflow

// source: https://www.securityfocus.com/bid/702/info There is a buffer overflow vulnerability in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel. It is important to know that the overflows are not in "/usr/bin/cancel" or "/usr/lpd/remote/cancel". The consequence of this vulnerability being...

sco_local_exploit.txt

Greetings, More SCO 5.0.x exploits, this time for scosession and scoterm. You'll only get egid=2bin out of scosession, but root for scoterm. Brock Tellier UNIX Systems Administrator Webley Systems www.webley.com --- scosessionx.c --- / SCO 5.0.x scosession local bin exploit sgid bin Will set...

sco_bof.txt

Subject: 19 SCO 5.0.5+Skunware98 buffer overflows To: [email protected] Greetings, After some light security auditing ; I've found approximately nineteen buffer overflows in various SCO 5.0.5+Skunkware98 programs. This was, by no means, a comprehensive audit of SCO's su/gids so I'm sure...

SCO_lpr_vuln.txt

Subject: SCO 5.0.5 lpr local root exploit To: [email protected] Greetings, There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more accurately, /usr/lpd/remote/lp, which lpr execs and passes your command line args on to. This means that while /usr/bin/lpr is sgid lp, we'll stil...

CVE-1999-0697

SCO Doctor allows local users to gain root privileges through a Tools option...

SCO Open Server 5.0.5 - X Library Buffer Overflow (1)

SCO Open Server 5.0.5 - X Library Buffer Overflow 1 // source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The...

SCO Open Server 5.0.5 - X Library Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the handling of the '-bg' command...

sco.termvision.win95.txt

Date: Wed, 31 Mar 1999 16:50:13 +0100 From: JJ Gray To: [email protected] Subject: Potential vulnerability in SCO TermVision Windows 95 client Hi folks, I recently downloaded a trial version of the SCO TermVision terminal emulation package for SCO Openserver 5 and Windows 95...

mscreen-sco.sh

Date: Sat, 26 Sep 1998 12:20:04 +0400 From: Leshka Subject: Root exploit for SCO OpenServer. The following text is in the "koi8-r" character set. Your display is set for the "US-ASCII" character set. Some characters may be displayed incorrectly. !/bin/sh Hi ! This is a buffer overflow exploit for...

SCO Open Server 5.0.5 - X Library Buffer Overflow (2)

SCO Open Server 5.0.5 - X Library Buffer Overflow 2 // source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The...

SCO Open Server 5.0.5 - XBase Buffer Overflow

SCO Open Server 5.0.5 - XBase Buffer Overflow // source: https://www.securityfocus.com/bid/479/info The XBase package that ships with SCO OpenServer 5.0. is vulnerable to several buffer overflow attacks in many different XBase tools. The tools that are installed setuid root allow local users to...

SCO Open Server 5.0.5 - XBase Buffer Overflow

// source: https://www.securityfocus.com/bid/479/info The XBase package that ships with SCO OpenServer 5.0. is vulnerable to several buffer overflow attacks in many different XBase tools. The tools that are installed setuid root allow local users to gain superuser privileges. This is because they...

CVE-1999-0411

Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p, including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a symlink attack, allowing a local user to gain root access...

CVE-1999-0476

A weak encryption algorithm is used for passwords in SCO TermVision, allowing them to be easily decrypted by a local user...

PT-1999-1157 · Sco · Sco Termvision

Name of the Vulnerable Software and Affected Versions: SCO TermVision affected versions not specified Description: A weak encryption algorithm is used for passwords, allowing them to be easily decrypted by a local user. Recommendations: At the moment, there is no information about a newer version...

CVE-1999-1450

Vulnerability in 1 rlogin daemon rshd and 2 scheme on SCO UNIX OpenServer 5.0.5 and earlier, and SCO UnixWare 7.0.1 and earlier, allows remote attackers to gain privileges...

SCO UNIX 5 calserver - Remote Buffer Overflow

SCO UNIX 5 calserver - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/2353/info Versions of SCO Unix calserver are vulnerable to a buffer overflow attack which can permit root access to a remote attacker. / include include include include include include mainargc, argv int...

SCO UNIX 5 calserver - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/2353/info Versions of SCO Unix calserver are vulnerable to a buffer overflow attack which can permit root access to a remote attacker. / include include include include include include mainargc, argv int argc; char argv; define calserverpipe...

SCO Unixware 7.07.0.17.17.1.1 - uidadmin Local Privilege Escalation

SCO Unixware 7.07.0.17.17.1.1 - uidadmin Local Privilege Escalation source: https://www.securityfocus.com/bid/842/info Certain versions of SCO Unixware ship with an exploitable version of the /usr/bin/uidadmin program. The problem lies in that 'uidadmin' runs with root privileges and performs...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'uidadmin' Local Privilege Escalation

source: https://www.securityfocus.com/bid/842/info Certain versions of SCO Unixware ship with an exploitable version of the /usr/bin/uidadmin program. The problem lies in that 'uidadmin' runs with root privileges and performs insecure writes to a scratch directory /tmp/ in this instance. A...