CVE-2003-0834

SCO Open UNIX and UnixWare - Buffer Overflow via DTHELPUSERSEARCHPATH or DTSEARCHPATH Environment Variable

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2003-0834. PoCs published by Marco Ivaldi.

AI-analyzed exploit summary This exploit targets a buffer overflow in the CDE libDtHelp library (CVE-2003-0834) on Solaris/SPARC systems, leveraging environment variables like DTHELPSEARCHPATH to execute arbitrary code via a ret-into-ld.so technique, bypassing non-executable stack protections.

Description

Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Marco Ivaldi · clocalsolaris
https://www.exploit-db.com/exploits/714

This exploit targets a buffer overflow in the CDE libDtHelp library (CVE-2003-0834) on Solaris/SPARC systems, leveraging environment variables like DTHELPSEARCHPATH to execute arbitrary code via a ret-into-ld.so technique, bypassing non-executable stack protections.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: CDE libDtHelp.so on Solaris 7/8/9
No auth needed
Prerequisites: Access to a vulnerable Solaris system with CDE installed · Ability to set environment variables · X server access for triggering the exploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · clocalsolaris
https://www.exploit-db.com/exploits/713

This exploit leverages a buffer overflow in the CDE libDtHelp library via the DTHELPSEARCHPATH environment variable to achieve local privilege escalation on Solaris/SPARC systems. It uses a carefully crafted environment and shellcode to execute arbitrary commands as root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: CDE libDtHelp.so on Solaris 7/8/9
No auth needed
Prerequisites: Access to a vulnerable Solaris/SPARC system · Ability to set environment variables · X server access for triggering the exploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory vendor-advisory x_refsource_hp
http://archives.neohapsis.com/archives/hp/2003-q4/0047.html
Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/8973
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57414
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/575804
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5141
Vendor Advisory vendor-advisory x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20040801-01-P

Scores

EPSS 0.0122
EPSS Percentile 64.7%

Details

Status published
Products (3)
sco/open_unix 8.0
sco/unixware 7.1.1
sco/unixware 7.1.3
Published Dec 01, 2003
Tracked Since Feb 18, 2026