Security updates for SCO OpenServer

Madrid, January 6, 2006 - SCO has published five security advisories reporting several vulnerabilities that affect versions 5.0.6, 5.0.7 and 6.0.0 of SCO OpenServer. They also announce the availability of the updates that fix them.

Below is a summary of the security flaws detected in OpenServer:

- Denial of Service in BIND (Berkeley Internet Name Daemon), which lies in a buffer overflow that can be triggered remotely. This vulnerability could allow an attacker to stop the resolution of domain names. It affects versions 5.0.6, 5.0.7 and 6.0.0.

- Execution of arbitrary code through a buffer overflow in the libTIFF library that processes TIFF image files. It could compromise the affected system if a specially-crafted TIFF image is sent and opened with an application that uses this library. It affects versions 5.0.6, 5.0.7 and 6.0.0.

- Multiple vulnerabilities in the handling and decompression of ´cpio´ files that could allow file permissions to be modified and new arbitrary files to be written using a directory traversal vulnerability. It affects versions 5.0.7 and 6.0.0.

- Denial of Service vulnerability based in ICMP packages, which could be exploited remotely to degrade or end TCP connections and deny service to legitimate users. It affects versions 5.0.6 and 5.0.7.

- Integer overflow in the LibXpm library that allows arbitrary code to run when processing a specially-crafted image. It affects versions 5.0.6, 5.0.7 and 6.0.0.

The security advisories with full details of these vulnerabilities, the versions affected and instructions for downloading and installing the updates are available at: http://www.sco.com/support/security/2006.html#OpenServer

Oxygen3 24h-365d
by Panda Software

2006-01-06 11:05

Back

IT News: