search menu icon-carat-right cmu-wordmark

CERT Coordination Center


SCO UnixWare bnuconvert contains buffer overflow via long string of characters sent as command line argument

Vulnerability Note VU#677611

Original Release Date: 2001-07-27 | Last Revised: 2001-07-27

Overview

A buffer overflow in bnuconvert, part of the UUCP package on SCO systems, can allow an intruder to gain elevated privileges.

Description

SCO UnixWare 7 ships with a utility package called UUCP. The UUCP package allows for the copying of files between different UNIX systems and the sending of commands for execution on a remote system. There is a buffer overflow in the bnuconvert application, which is part of the package. A malicious user can use these vulnerabilities to gain elevated privileges.

Impact

A local user can gain elevated privileges.

Solution

Caldera has released binaries that fix the problem. They are located at ftp://ftp.sco.com/pub/security/unixware/sr847405/.

Vendor Information

677611
Expand all

SCO

Updated:  July 27, 2001

Status

  Vulnerable

Vendor Statement

ftp://ftp.sco.com/pub/security/unixware/sr847405/sr847405.txt

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Note that Caldera purchased SCO.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was reported in a Caldera-SCO security advisory

This document was written by Jason Rafail.

Other Information

CVE IDs: None
Severity Metric: 0.18
Date Public: 2001-06-27
Date First Published: 2001-07-27
Date Last Updated: 2001-07-27 19:45 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.