====================================================================== Strategic Reconnaissance Team Security Advisory(SRT2001-02) Topic: SCO 5.0.6 issues (recon) Vendor: SCO Release Date: 03/27/01 ====================================================================== .: Description SCO OpenServer 5.0.6 ships with a suid root /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon. Recon has poor handling of command line arguments resulting in a buffer overflow. The core is dumped upon feeding recon more than 1315 chars .: Impact /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'` Memory fault - core dumped This problem makes it possible to overwrite memory space of the running process, and potentially execute code with the inherited privileges of root. .: Workaround chmod -s /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon .: Systems Affected SCO OpenServer 5.0.6 upgrade from 5.0.x and 5.0.6 fresh install. .: Proof of Concept To be released at a later time. .: Vendor Status Vendor was notified on 03/22/01. Vendor lab tests confirmed the issue. Patch status is unknown. .: Credit Kevin Finisterre [EMAIL PROTECTED], [EMAIL PROTECTED] ====================================================================== ©Copyright 2001 Secure Network Operations , Inc. All Rights Reserved. Strategic Reconnaissance Team | [EMAIL PROTECTED] http://recon.snosoft.com | http://www.snosoft.com ----------------------------------------------------------------------
