Description
SCO Internet Manager (mana) allows local users to execute arbitrary programs by setting the REMOTE_ADDR environment variable to cause menu.mana to run as if it were called from ncsa_httpd, then modifying the PATH environment variable to point to a malicious "hostname" program.
Product(s):
- SCO OpenServer 5.0.5
- Santa Cruz Operation (SCO) OpenServer 5.0.6
- Santa Cruz Operation (SCO) OpenServer 5.0.7
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2003-0742, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2003-0742 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.