SCO Security Advisory
Subject: OpenLinux: slocate local user buffer overflow
Advisory number: CSSA-2004-001.0
Issue date: 2004 February 10
Cross reference: sr886033 fz528414 erg712456
1. Problem Description
Heap-based buffer overflow in main.c of slocate 2.6,
and possibly other versions, may allow local users to gain
privileges via a modified slocate database that causes a negative
“pathlen” value to be used. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0848 to this issue.
2. Vulnerable Supported Versions
System Package OpenLinux 3.1.1 Server prior to slocate-2.7-1.i386.rpm OpenLinux 3.1.1 Workstation prior to slocate-2.7-1.i386.rpm
3. Solution
The proper solution is to install the latest packages.
Many customers find it easier to use the Caldera System Updater,
called cupdate (or kcupdate under the KDE environment), to update
these packages rather than downloading and installing them by
hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/RPMS4.2 Packages
fd4e0b81e27fd236fcf0e34c28dcca2c slocate-2.7-1.i386.rpm
4.3 Installation
rpm -Fvh slocate-2.7-1.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/SRPMS4.5 Source Packages
3a2adce6e30bdcba92fe6a7f70216461 slocate-2.7-1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/RPMS5.2 Packages
44f7234c2a58efada5512157bc421d78 slocate-2.7-1.i386.rpm
5.3 Installation
rpm -Fvh slocate-2.7-1.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/SRPMS5.5 Source Packages
e2f70c80ae832d1267ce22e62ea90d15 slocate-2.7-1.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848
http://marc.theaimsgroup.com/?l=bugtraq&m=106546447321274&w=2
http://marc.theaimsgroup.com/?l=bugtraq&m=106589631819348&w=2http://www.ebitech.sk/patrik/SA/SA-20031006.txt
http://www.ebitech.sk/patrik/SA/SA-20031006-A.txt
SCO security resources:
http://www.sco.com/support/security/index.htmlThis security fix closes SCO incidents sr886033 fz528414
erg712456.
7. Disclaimer
SCO is not responsible for the misuse of any of the
information we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO
products.
8. Acknowledgements
SCO would like to thank Patrik Hornik
Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.
LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.
Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.