CVE-1999-0830

Vulnerability

A buffer overflow vulnerability exists in the SUID program Xsco on certain versions of SCO UnixWare, including UnixWare 7, 7.0.1, and 7.1. The program fails to properly validate user-supplied data when processing arguments, leading to the overflow [1].

Exploitation

An attacker can exploit this vulnerability by providing a long argument to the Xsco command. This is a local vulnerability, meaning the attacker must have access to the affected system to execute the malicious command. The exploit involves crafting a specific string that triggers the buffer overflow [1].

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the Xsco program. Since Xsco is a SUID program, this can lead to a full system compromise, allowing the attacker to gain elevated privileges and control over the affected system [1].

Mitigation

Patches for this vulnerability are not explicitly mentioned in the available references. Users are advised to check for updates from SCO or consider disabling or restricting the use of the Xsco command if possible. The affected versions are UnixWare 7, 7.0.1, and 7.1 [1].