Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » CSSA-2002-SCO.14-X server allows access to any shared

CSSA-2002-SCO.14-X server allows access to any shared

by Nikola Strahija on April 9th, 2002 Any user with local X access can exploit the MIT-SHM extension and gain read/write access to any shared memory segment on the system.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------
Open UNIX 8.0.0 xserver
UnixWare 7.1.1 xserver


3. Solution

The proper solution is to install the latest packages.


4. Open UNIX 8.0.0

4.1 Location of Fixed Binaries

ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.14


4.2 Verification

MD5 (xserver.800a.pkg) = 471bd0d4c43b32d4b04003d78a218c97

md5 is available for download from
ftp://stage.caldera.com/pub/security/tools/


4.3 Installing Fixed Binaries

Upgrade the affected binaries with the following commands:

Download xserver.800a.pkg to the /var/spool/pkg directory

# pkgadd -d /var/spool/pkg/xserver.800a.pkg


5. UnixWare 7.1.1

5.1 Location of Fixed Binaries

ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.14


5.2 Verification

MD5 (xserver.711b.pkg) = 545aafcdcfff532ed25dbffea0d06336

md5 is available for download from
ftp://stage.caldera.com/pub/security/tools/


5.3 Installing Fixed Binaries

Upgrade the affected binaries with the following commands:

Download xserver.711b.pkg to the /var/spool/pkg directory

# pkgadd -d /var/spool/pkg/xserver.711b.pkg


6. References

Specific references for this advisory:
none

Caldera UNIX security resources:
http://stage.caldera.com/support/security/

Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html

This security fix closes Caldera incidents sr860994, fz520243
and erg711973.


7. Disclaimer

Caldera International, Inc. is not responsible for the
misuse of any of the information we provide on this website
and/or through our security advisories. Our advisories are
a service to our customers intended to promote secure
installation and use of Caldera products.


8. Acknowledgements

Roberto Zunino discovered and researched this vulnerability.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »