|
Vulnerability recon Affected SCO OpenServer 5.0.6 upgrade from 5.0.x and 5.0.6 fresh install Description Following is based on a Strategic Reconnaissance Team Security Advisory (SRT2001-02). SCO OpenServer 5.0.6 ships with a suid root /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon. Recon has poor handling of command line arguments resulting in a buffer overflow. The core is dumped upon feeding recon more than 1315 chars: /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'` Memory fault - core dumped This problem makes it possible to overwrite memory space of the running process, and potentially execute code with the inherited privileges of root. Credit goes to Kevin Finisterre. Solution chmod -s /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon as workaround. Patch: ftp://ftp.sco.com/SSE/sse072b.tar.Z ftp://ftp.sco.com/SSE/sse072b.tar.bz2 ftp://ftp.sco.com/SSE/sse072b.ltr SSE072B supersedes SSE072