-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenLinux: ucd-snmp remote heap overflow
Advisory number: 	CSSA-2003-029.0
Issue date: 		2003 October 29
Cross reference:	sr883603 fz528212 erg712406 CAN-2002-1570
______________________________________________________________________________


1. Problem Description

	ucd-snmp is a set of tools relating to the Simple Network
	Management Protocol (SNMP), which is used for remote
	administration and monitoring of network devices and
	services. 

	Juan M. de la Torre found a remote heap overflow vulnerability 
	in snmpnetstat (a tool used to retrieve information about a 
	remote host). When a list of interfaces is requested, a malicious 
	server can return information in a way that will cause a heap 
	overflow in snmpnetstat. A remote atacker able to control a snmp 
	server can exploit this vulnerability to execute arbitrary code 
	with the privileges of the user running snmpnetstat.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) 
	has assigned the following name CAN-2002-1570 to this issue.

2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to ucd-snmp-4.2.1-18.i386.rpm
					prior to ucd-snmp-devel-4.2.1-18.i386.rpm
					prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm
					prior to ucd-snmp-utils-4.2.1-18.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to ucd-snmp-4.2.1-18.i386.rpm
					prior to ucd-snmp-devel-4.2.1-18.i386.rpm
					prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm
					prior to ucd-snmp-utils-4.2.1-18.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/RPMS

	4.2 Packages

	126ee06bd94f366289364150ed7d87fb	ucd-snmp-4.2.1-18.i386.rpm
	6653905d5244636d0a699c48d447d627	ucd-snmp-devel-4.2.1-18.i386.rpm
	947bf938d44ea9d03a5d2d242244855c	ucd-snmp-tkmib-4.2.1-18.i386.rpm
	ec04d382fd0010911277e7635b2312b7	ucd-snmp-utils-4.2.1-18.i386.rpm

	4.3 Installation

	rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/SRPMS

	4.5 Source Packages

	adcdbf58ba2b5ef0075c46fcc80dc399	ucd-snmp-4.2.1-18.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/RPMS

	5.2 Packages

	126ee06bd94f366289364150ed7d87fb	ucd-snmp-4.2.1-18.i386.rpm
	6653905d5244636d0a699c48d447d627	ucd-snmp-devel-4.2.1-18.i386.rpm
	947bf938d44ea9d03a5d2d242244855c	ucd-snmp-tkmib-4.2.1-18.i386.rpm
	ec04d382fd0010911277e7635b2312b7	ucd-snmp-utils-4.2.1-18.i386.rpm

	5.3 Installation

	rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/SRPMS

	5.5 Source Packages

	adcdbf58ba2b5ef0075c46fcc80dc399	ucd-snmp-4.2.1-18.src.rpm


6. References

	Specific references for this advisory:
		http://www.securityfocus.com/archive/1/248141
		http://www.securityfocus.com/bid/3780
		http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1570

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr883603 fz528212
	erg712406.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	SCO would like to thank Juan M. de la Torre and  Axioma Security 
	Research for discovering and researching this vulnerability.

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (SCO/UNIX_SVR5)

iD8DBQE/oXqabluZssSXDTERAv60AJ9Z/JBd2k+kKAS0hJBhWZYuXzZqegCfbWfz
qrnqLWysrI5p5LHmi4u8Aeo=
=xc81
-----END PGP SIGNATURE-----