CVE-2008-0310

Published: Apr 7, 2008Modified: Apr 23, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append to arbitrary files via ".." sequences in an unspecified environment variable, probably PKGINST.

Affected (1)

Products: Sco: Unixware

Sco

1 product

Unixware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sco Unixware	Version 7.1.4

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (14)

http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt

Source: cve@mitre.org

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676

Source: cve@mitre.org

http://secunia.com/advisories/29657

Source: cve@mitre.org

Vendor Advisory

http://www.sco.com/support/update/download/release.php?rid=324

Source: cve@mitre.org

PatchVendor Advisory

http://www.securitytracker.com/id?1019787

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/41759

Source: cve@mitre.org

https://www.exploit-db.com/exploits/5355

Source: cve@mitre.org

http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt