Exploitation Summary
EIP tracks 3 public exploits for CVE-1999-0828. PoCs published by Brock Tellier.
AI-analyzed exploit summary This exploit leverages a buffer overflow in UnixWare 7.1's `pkgcat` to execute arbitrary code with `dacread` privileges, allowing unauthorized access to `/etc/shadow`. It generates shellcode to spawn a program that reads the shadow file.
Description
UnixWare pkg commands such as pkginfo, pkgcat, and pkgparam allow local users to read arbitrary files via the dacread permission.
Exploits (3)
This exploit leverages a buffer overflow in UnixWare 7.1's `pkgcat` to execute arbitrary code with `dacread` privileges, allowing unauthorized access to `/etc/shadow`. It generates shellcode to spawn a program that reads the shadow file.
The exploit demonstrates an information leakage vulnerability in SCO UnixWare 7.1's package utilities (e.g., pkgparam), which can read arbitrary files (e.g., /etc/shadow) due to improper Discretionary Access Controls (DAC) via /etc/security/tcb/privs.
This exploit leverages a buffer overflow in UnixWare 7.1's `pkginstall` to execute arbitrary code with `dacread` privileges, allowing unauthorized access to `/etc/shadow`. The shellcode spawns a helper program that reads the shadow file.