Secunia Security Advisory – Two vulnerabilities have been reported in osh, which can be exploited by malicious, local users to gain escalated privileges. 1) A boundary error exists in the function iopen() in main.c and can be exploited to cause a buffer overflow by supplying an overly long argument. Example: /usr/sbin/osh exit [more than 1024 bytes] 2) A boundary error exists in the writable() function in handlers.c and can be exploited to cause a buffer overflow by running osh from a directory with a directory name of more than 255 bytes. Successful exploitation may allow execution of arbitrary code with root privileges. The vulnerabilities have been reported in version 1.7. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/41460/sa14159.txt
Source: https://packetstormsecurity.com/files/41460/Secunia-Security-Advisory-14159.html