APP: Netscape Fastrack scohelp Buffer Overflow
This signature detects attempts to exploit a known vulnerability against SCO Unixware's Netscape Fasttrack scohelp httpd service. An attacker can supply an overly long URL to potentially gain command-line access as the user running the service, to the victim host. A successful attack can cause a buffer overflow condition. This is known to affect scohelp 2.01a running on SCO Unixware 7.1.
Extended Description
SCO Unixware 7 default installation includes scohelp, an http server that listens on port 457/tcp and allows access to manual pages and other documentation files. The search CGI script provided for that purpose has a vulnerability that could allow any remote attacker to execute arbitrary code on the vulnerable machine with privileges of user "nobody". This poses a threat that could result in the remote compromise of the vulnerable host and provide a staging point from where an attacker could escalate privileges.
Affected Products
Sco unixware
Short Name
APP:SCOHELP-OF1
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
Buffer CVE-2000-1014 Fastrack Netscape Overflow bid:1717 scohelp
Release Date
04/22/2003
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
Port
TCP/457
False Positive
Unknown
Vendors
Sco
CVSS Score
7.5