SCO OpenServer Multiple Local Privilege Escalation Vulnerabilities

This script is Copyright (C) 2003-2011 Tenable Network Security, Inc.


Synopsis :

The remote server is affected by multiple local privilege escalation
vulnerabilities.

Description :

According to its telnet banner, the remote host is a SCO Unix server
running OpenServer version 5.0.5, 5.0.6, or 5.0.7. Such versions are
vulnerable to two distinct exploits. Namely,

- Xsco can be locally exploited by any valid user in
order to escalate their privileges to 'root'. The bug
is due to improper input handling when running the
command line switch '-co'.

- There is a vulnerability in the MIT-SHM extension within
all X servers that are running as root. Any user with
local X access can exploit the MIT-SHM extension and
gain read/write access to any shared memory segment on
the system.

See also :

http://marc.info/?l=bugtraq&m=101776858410652&w=2
http://marc.info/?l=bugtraq&m=103547625009363&w=2
ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.26

Solution :

Install the patched binaries referenced in the vendor's advisory.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.3
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Misc.

Nessus Plugin ID: 11895 ()

Bugtraq ID: 4396
4985

CVE ID: CVE-2002-0158
CVE-2002-0164