Notified: July 15, 2002 Updated: August 19, 2002
Cray, Inc. is vulnerable however it is by design and will remain that way to maintain POSIX compliancy. According to the POSIX standards for uudecode: "If the pathname of the file to be produced exists, and the user does not have write permission on the file, uudecode will terminate with an error. If the pathname of the file to be produced exists, and the user has write permission on that file, the existing file will be overwritten." So, if a user has root write permission then yes they can overwrite a file using uudecode (or cat, or other various unix commands).
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.