A vulnerability in the way UnixWare 7 stores old unpatched binaries (a patched binary is usually used to fix a security vulnerability or other bugs) in an insecure place allowing local users to execute the old version of the binary and possibly compromise the operating system. This obviously defies the whole idea of patching those files in the first place.
Credit:
This vulnerability has been discovered by: ktwo
When patches are applied to binaries on UnixWare 7, the original, unpatched binary files (with the suid/sgid bits maintained) are stored in /var/sadm. By default, the permission setting on this directory is 755. This allows normal users to execute and exploit old binaries leftover from patching.
Patch:
Run 'chmod o-rx /var/sadm' to remove read/execution privileges for normal users.
