PT-2002-1316 · Unixware · Unixware

Published 2002-05-29 · Updated 2008-09-11 · CVE-2002-0246

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UnixWare version 7.1.1

Description A format string issue exists in the message catalog library functions of UnixWare, allowing local users to elevate privileges. This is achieved by modifying the LC MESSAGE environment variable to access other message catalogs that contain format strings from setuid programs, such as vxprint.

Recommendations For UnixWare version 7.1.1, as a temporary workaround, consider restricting access to setuid programs like vxprint until a patch is available. Additionally, avoid modifying the LC MESSAGE environment variable to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0246

Affected Products

Unixware

References · 6

• 🔥 http://online.securityfocus.com/archive/1/255414 · Exploit
• 🔥 https://exploit-db.com/exploits/21284 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0246 · Security Note
• ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.3/CSSA-2002-SCO.3.txt · Vendor Advisory
• http://iss.net/security_center/static/8113.php · Vendor Advisory
• http://securityfocus.com/bid/4060 · Note