Secunia

Description

SCO has issued updated packages for mgetty. These fix two vulnerabilities, which can be exploited to compromise a vulnerable system or escalate privileges.

Mgetty doesn't validate the user name supplied by the modem, when calling external programs. This allows malicious users to overflow the buffer and execute arbitrary code with root privileges.

Also, local users are able to circumvent the permissions in faxspool. This allows local users to send faxes regardless of permissions.

Solution
Use the Caldera System Updater, called cupdate/kcupdate to update the packages or download and install them manually.
Further details available in Customer Area

Original Advisory
ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-021.0.txt

Deep Links
Links available in Customer Area