COMMAND

	webtop bad suid gives local root

SYSTEMS AFFECTED

	UnixWare 7, Open UNIX 8

PROBLEM

	\'jggm\' [JeGalGhongMyeung] found :
	

	The setuid scripts in the webtop  product  may  be  used  to  gain  root
	privileges.
	

	

SOLUTION

	 Patch :

	 =====

	

	ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.6/

	

	 Workaround :

	 ==========

	

	If  the  webtop  functionality  is  not  needed,   remove   the   setuid
	permissions from the scripts:
	

	# chmod -s /opt/webtop/bin/i3un0212/cgi-bin/admin/scoadminreg.cgi

	# chmod -s /opt/webtop/bin/i3un0212/cgi-bin/admin/service_action.cgi