SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the as address space file for a process ID (PID) by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program, which leaves the descriptor open to the user.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Open_unix | Sco | 8.0 (including) | 8.0 (including) |
| Unixware | Sco | 7.1.1 (including) | 7.1.1 (including) |
| Unixware | Sco | 7.1.3 (including) | 7.1.3 (including) |