vendor:
UnixWare
by:
SecurityFocus
7.2
CVSS
HIGH
Format String Vulnerability
134
CWE
Product Name: UnixWare
Affected Version From: UnixWare 7.1.1
Affected Version To: UnixWare 7.1.3
Patch Exists: YES
Related CWE: N/A
CPE: o:caldera:unixware:7.1.3
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: UnixWare
2002
UnixWare Format String Vulnerability
A format string vulnerability in the locale subsystem of UnixWare could lead to a user gaining elevated privileges. A local user could potentially supply maliciously crafted message catalogs through the LC_MESSAGES environment variable. This could allow a local user to load arbitrary message catalogs into setuid or setgid programs, and execute arbitrary code with setuid/setgid privileges.
Mitigation:
Update to the latest version of UnixWare.