search menu icon-carat-right cmu-wordmark

CERT Coordination Center

SCO UnixWare bnuconvert contains buffer overflow via long string of characters sent as command line argument

Vulnerability Note VU#677611

Original Release Date: 2001-07-27 | Last Revised: 2001-07-27


A buffer overflow in bnuconvert, part of the UUCP package on SCO systems, can allow an intruder to gain elevated privileges.


SCO UnixWare 7 ships with a utility package called UUCP. The UUCP package allows for the copying of files between different UNIX systems and the sending of commands for execution on a remote system. There is a buffer overflow in the bnuconvert application, which is part of the package. A malicious user can use these vulnerabilities to gain elevated privileges.


A local user can gain elevated privileges.


Caldera has released binaries that fix the problem. They are located at

Vendor Information

Affected   Unknown   Unaffected


Updated:  July 27, 2001



Vendor Statement

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Note that Caldera purchased SCO.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A



This vulnerability was reported in a Caldera-SCO security advisory

This document was written by Jason Rafail.

Other Information

CVE IDs: None
Severity Metric: 0.18
Date Public: 2001-06-27
Date First Published: 2001-07-27
Date Last Updated: 2001-07-27 19:45 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.