Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh (2) auditsh (3) authsh (4) backupsh (5) lpsh (6) sysadm.menu or (7) termsh.