Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent (2) haalert (3) haattr (4) hacli (5) hacli_runcmd (6) haclus (7) haconf (8) hadebug (9) hagrp (10) hahb (11) halog (12) hareg (13) hares (14) hastatus (15) hasys (16) hatype (17) hauser and (18) tststew.