Bugtraq mailing list archives
Security Update: [CSSA-2001-SCO.5] UnixWare: packaging tool exploits
From: sco-security () caldera com
Date: Fri, 29 Jun 2001 14:55:31 -0700
To: bugtraq () securityfocus com security-announce () lists securityportal com announce () lists caldera com ___________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: UnixWare: packaging tool exploits Advisory number: CSSA-2001-SCO.5 Issue date: 2001 June 29 Cross reference: ___________________________________________________________________________ 1. Problem Description The packaging tools can be exploited to print /etc/shadow, leading to a probable root compromise. 2. Vulnerable Versions Operating System Version Affected Files ------------------------------------------------------------------ UnixWare 7 All /usr/bin/pkginfo /usr/bin/pkgparam /usr/bin/pkgtrans /usr/sbin/pkgadd /usr/sbin/pkgcat /usr/sbin/pkginstall /usr/sbin/pkgrm 3. Workaround None. 4. UnixWare 7 4.1 Location of Fixed Binaries ftp://ftp.sco.com/pub/security/unixware/sr847997/ 4.2 Verification md5 checksums: 5d75084d724882c4baad12a255c00776 erg711743.Z md5 is available for download from ftp://ftp.sco.com/pub/security/tools/ 4.3 Installing Fixed Binaries Upgrade the affected binaries with the following commands: # uncompress /tmp/erg711713a.Z # pkgadd -d /tmp/erg711713a 5. References http://www.technotronic.com/xnec/ http://www.calderasystems.com/support/security/index.html 6. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on our website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera International, Inc. products. 7.Acknowledgements Caldera International wishes to thank Brock Tellier (btellier () usa net) for his analysis and help concerning this issue. In addition, an acknowledgement to Mr. Tellier was inadvertently omitted from advisory [CSSA-2001-SCO.1]. ___________________________________________________________________________
Attachment:
_bin
Description:
Current thread:
- Security Update: [CSSA-2001-SCO.5] UnixWare: packaging tool exploits sco-security (Jul 02)