CVE-1999-0845: Buffer Overflow
Buffer overflow in SCO su program allows local users to gain root access via a long username.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
xinuos/unixware sufrom your environment.If the su program is not required, uninstall or remove the su binary from affected systems to eliminate the vulnerable component until a vendor patch is available.
- Configuration
Remove the setuid bit on the su binary or change its permissions/group so only trusted administrative accounts (e.g., wheel) can execute su, preventing local users from exploiting a long-username buffer overflow to gain root.
SCO su (Xinuos UnixWare) setuid / executable permissions = remove setuid / restrict execution to admin group - Compensating control
Restrict local account creation and local login access to trusted administrators only; limit who can obtain shell access or log in locally (console/SSH) until a vendor-supplied fix is available to mitigate risk of local privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0845?
CVE-1999-0845 is considered a critical vulnerability due to its ability to allow local users to gain root access.
How do I fix CVE-1999-0845?
To fix CVE-1999-0845, apply patches provided by the SCO vendor for UNIXware 7.0.
Who is affected by CVE-1999-0845?
CVE-1999-0845 affects local users on systems running SCO UNIXware version 7.0.
What type of vulnerability is CVE-1999-0845?
CVE-1999-0845 is a buffer overflow vulnerability that exploits weak handling of input in the su program.
Can CVE-1999-0845 be exploited remotely?
No, CVE-1999-0845 can only be exploited locally, requiring access to the system by a user.