SCO UnixWare pkgadd and pkgrm privilege escalation
| unixware-pkgadd-privilege-escalation (41200) |  High Risk |
Description:
SCO UnixWare could allow a local attacker to gain elevated privileges, caused by the improper filtering of environment variables by the pkgadd and pkgrm commands. By setting the environment variable to a certain value containing "dot dot" sequences (/../), a local attacker could exploit this vulnerability to overwrite or create system files and possibly execute arbitrary code on the system with root privileges.
Platforms Affected:
- SCO, SCO UnixWare 7.1.4
Remedy:
Refer to SCOSA-2008.1 for patch, upgrade or suggested workaround information. See References.
Consequences:
Gain Privileges
References:
- SCOSA-2008.1, pkgadd(1M) Directory Traversal Vulnerability at ftp://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt.
- The SCO Group Web site, UnixWare 7.1.4 > pkgadd(1M) security patch at http://www.sco.com/support/update/download/release.php?rid=324.
- BID-28236: SCO UnixWare 'pkgadd' Local Privilege Escalation Vulnerability
- CVE-2008-1343: Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vectors.
- SA29370: UnixWare "pkgadd" Directory Traversal Vulnerability
Reported:
Feb 27, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net