-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenServer 5.0.7 OpenServer 6.0.0 : cpio Multiple Vulnerabilities
Advisory number:	SCOSA-2006.2
Issue date:		2006 January 03
Cross reference:	sr893933 fz532332 erg712853
			sr894845 fz532911 erg712912
			CVE-2005-1111 CVE-2005-1229
______________________________________________________________________________


1. Problem Description

	A race condition in cpio allows local users to modify
	permissions of arbitrary files via a hard link attack on a file
	while it is being decompressed, whose permissions are changed by
	cpio after the decompression is complete.
	
	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the name CVE-2005-1111 to this issue.
	
	A directory traversal vulnerability allows remote attackers to
	write to arbitrary directories via a .. (dot dot) in a cpio
	file.
	
	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the name CVE-2005-1229 to this issue


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	OpenServer 5.0.7 		/usr/gnu/bin/gcpio
	OpenServer 6.0.0 		/usr/bin/cpio, /usr/bin/cpio.osr5


3. Solution

	The proper solution is to install the latest packages.


4. OpenServer 5.0.7

	4.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2


	4.2 Verification

	MD5 (p532332.507_vol.tar) = 416ce0e1f6ba629eadc883ca1283fba7

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following sequence:

	1) Download p532332.507_vol.tar file to a directory.

	2) Extract VOL* files.

	   # tar xvf p532332.507_vol.tar

	3) Run the custom command, specify an install from media images,
	   and specify the directory as the location of the images.


5. OpenServer 6.0.0

	5.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2


	5.2 Verification

	MD5 (p532911.600_vol.tar) = 2224558523782dbae0b529fb0cf0ff37

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	5.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following sequence:

	1) Download p532911.600_vol.tar file to a directory.

	2) Extract VOL* files.

	   # tar xvf p532911.600_vol.tar

	3) Run the custom command, specify an install from media images,
	   and specify the directory as the location of the images.


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1111
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1229
		http://xforce.iss.net/xforce/xfdb/20204

	SCO security resources:
		http://www.sco.com/support/security/index.html

	SCO security advisories via email
		http://www.sco.com/support/forums/security.html

	This security fix closes SCO incidents sr893933 fz532332
	erg712853 sr894845 fz532911 erg712912.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers
	intended to promote secure installation and use of SCO
	products.


8. Acknowledgments

	The SCO Group would like to thank Imran Ghory for the initial
	report.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (UnixWare)

iD8DBQFDutvSaqoBO7ipriERAotsAJ93QFuCrfqnGpo9ZI/0WrAZY2QESwCeMB0P
/k50mfVF8FuQU7x/P0lHfyo=
=RLvy
-----END PGP SIGNATURE-----