Secunia

A vulnerability has been identified in SCO OpenServer, which can be exploited by malicious, local users to escalate their privileges on a vulnerable system.

SCO Internet Manager (mana) runs via "ncsa_httpd" (port 615/tcp) and is password protected. However, it is possible to execute the file "menu.mana" locally as if it was run via the "nsca_httpd" password protected area by setting the environment variable "REMOTE_ADDR" to "127.0.0.1" .

It is furthermore possible to execute arbitrary ".mana" files with "root" privileges by manipulating the "PATH_INFO" and "PATH" environment variables.

Solution
Install the latest packages.
Further details available in Customer Area

Provided and/or discovered by
Joel Soderberg and Christer Oberg, Texonet.

Original Advisory
SCO:
ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.19/CSSA-2003-SCO.19.txt

Texonet:
http://www.texonet.com/advisories/TEXONET-20030902.txt

Deep Links
Links available in Customer Area