TUCoPS :: Unix :: General :: unix4911.htm

COMMAND
	lpstat buffer overflow
SYSTEMS AFFECTED
	OpenServer 5.0.6a and previous
PROBLEM
	As published in Caldera Security Advisory CSSA-2001-SCO.38, a locally
	exploitable buffer overflow exists in lpstat command, even with sse072.
SOLUTION
	 Workaround
	 ==========
	
	If the lpstat command is not required, remove the setgid bit from the
	binary:
	
	chmod g-s /usr/bin/lpstat
	
	
	 Fixed Binaries
	 ==============
	
		ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.38/
	
	
	 md5 checksums:
	
		2deab6d340bb3790104fa0cb8ae36e6c	erg711871.pkg.Z