PT-2008-1950 · Sco · Sco Unixware

Qaaz · Published 2008-04-07 · Updated 2017-09-29 · CVE-2008-0310

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SCO UnixWare version 7.1.4 before p534589

Description A directory traversal issue exists, allowing local users to create or append to arbitrary files. This is achieved by using ".." sequences in an unspecified environment variable, likely PKGINST, within the pkgadd environment.

Recommendations For SCO UnixWare version 7.1.4 before p534589, consider restricting access to the pkgadd command until a patch is available, specifically by limiting the ability to manipulate the environment variable that is being exploited.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0310

Affected Products

Sco Unixware

References · 8

• 🔥 https://exploit-db.com/exploits/5355 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0310 · Security Note
• http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt · Vendor Advisory
• http://sco.com/support/update/download/release.php?rid=324 · Vendor Advisory
• http://secunia.com/advisories/29657 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41759 · Note
• http://securitytracker.com/id?1019787 · Note