___________________________________________________________________________

	    Caldera International, Inc. Security Advisory

Subject:		Open UNIX, UnixWare 7: lp utility commands: buffer overflows
Advisory number: 	CSSA-2001-SCO.16
Issue date: 		2001 October 18
Cross reference:	CSSA-2001-SCO.16 ( released 2001 September 18 )
___________________________________________________________________________



1. Problem Description
	
	Very long arguments to the line printer utilities accept,
	reject, enable and disable caused a segmentation violation.
	This could be used by an unauthorized user to gain privilege.
		


2. Vulnerable Versions

	Operating System	Version		Affected Files
	------------------------------------------------------------------
	UnixWare 7		All		/usr/bin/enable
						/usr/bin/disable
						/usr/sbin/accept
						/usr/sbin/reject

	Open UNIX 8		8.0.0		/usr/bin/enable
						/usr/bin/disable
						/usr/sbin/accept
						/usr/sbin/reject


3. Workaround

	None.


4. UnixWare 7, Open UNIX 8

  4.1 Location of Fixed Binaries

	ftp://stage.caldera.com/pub/security/openunix/CSSA-2001-SCO.16/


  4.2 Verification

	md5 checksums:
	
	e7886b0b81ed4f3975a162a4b2b81a0d	erg711788c.Z


	md5 is available for download from

		ftp://stage.caldera.com/pub/security/tools/


  4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	# uncompress /tmp/erg711788c.Z
	# pkgadd -d /tmp/erg711788c


5. References

	This and other advisories are located at
		http://stage.caldera.com/support/security

	This advisory addresses Caldera Security internal incidents
	sr849818, sr847404, and sr847403.

6. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on our website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera International products.


7. Acknowledgements

	Caldera International wishes to thank KF <dotslash@snosoft.com>
        for discovering and reporting this problem.

	 
___________________________________________________________________________