A vulnerability has been reported in CDE (Common Desktop Environment), which can be exploited by malicious, local users to escalate their privileges.

The vulnerability is caused due to a boundary error in CDE libDtHelp when handling the "DTHELPUSERSEARCHPATH" environment variable. This can be exploited via suid application linked to libDtHelp (eg. dtprintinfo) to cause a buffer overflow by inserting an overly long, specially crafted string and then invoking Help.

This can also be exploited using the "LOGNAME" environment variable.

The vulnerability affects the following products:
* Xi Graphics deXtop CDE 3.0
* SCO Open UNIX 8.0.0
* SCO UnixWare 7.1.3 and 7.1.1

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Discovered by:
Kevin Kotas

Further information provided by:
iDEFENSE Labs

Changelog
Further details available in Customer Area

Original Advisory
CERT VU#575804:
http://www.kb.cert.org/vuls/id/575804

SCO UnixWare and Open UNIX:
ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.31/CSSA-2003-SCO.31.txt

Xi Graphics deXtop CDE:
ftp://ftp.xig.com/pub/updates/dextop/3.0/DEX3000.003.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area