|
Vulnerability scohelphttp Affected UnixWare 7 Description Following ia based on a Defcom Labs Advisory def-2000-01. The search function "/search97cgi/vtopic" used by the UnixWare 7 "scohelphttp" webserver (tcp port 457) contains a bug that lets anyone with access to scohelphttp view any world-readable file on the host. The view function of the searcg97cgi/vtopic cgi has a parameter called ViewTemplate that specifies an HTML template file for search results: http://unixware7box:457/search97cgi/vtopic?action=view&ViewTemplate= The contents of this variable is not checked for "/../" paths, thus enabling anyone to view any file readable to the webserver process. The webserver runs as user "nobody" by default, limiting the accesible files to files that are "world readable" (/etc/passwd not /etc/shadow). Solution For workaround, run the following commands (as root): /usr/ns-home/httpd-scohelphttp/stop /usr/ns-home/httpd-scohelphttp/disable To stop and disable the scohelphttp webserver. Await fix from SCO. This issue was brought to SCO's attention on the 18th of July and was assigned the ID SCO-375377.