457
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — scohelp is a discontinued SCO UnixWare documentation server with a known remote-code-execution CVE and near-zero measured open-frequency today, so a responsive port 457 is an anomaly to investigate rather than a normal internet-facing or internal service.
- // common applications
- SCOhelp (SCO UnixWare) Traffic on this port is most often the bundled scohelp HTTP documentation daemon shipped with SCO UnixWare; no other applications have been credibly reported using port 457 in sources checked as of August 2026.
- // analyst note
- An open port 457 today most likely reflects a retired or unpatched SCO UnixWare deployment rather than active mainstream use; treat as anomalous and investigate rather than assume benign.
- // if you see it open
- NVD documents three scohelp/UnixWare 7 CVEs. CVE-2000-1014 (published 2000-12-11) is a format-string vulnerability in the search97.cgi CGI script via the queryText parameter, allowing remote attackers to execute arbitrary commands. CVE-2000-0842 (published 2000-11-14) is a separate directory-traversal vulnerability in search97cgi/vtopic allowing remote attackers to read arbitrary files via a '..' attack. CVE-2000-0130 (published 2000-01-27) is a buffer overflow in the SCO scohelp program allowing remote command execution. A Core Security Labs advisory referencing these issues returned an access error on fetch and could not be independently verified. No malware/trojan association is recorded as of an August 2026 check of auditmypc.com and GRC's Port Authority. Measured open-frequency is near zero, consistent with a retired legacy service.
About port 457/tcp.
Port 457/tcp carries scohelp, the legacy HTTP-based help and documentation server bundled with SCO UnixWare; it belongs to a retired commercial Unix product line and should not be exposed to the public internet — an open 457 today is an anomaly worth investigating rather than a normal service.
IANA registers 457 as scohelp on both TCP and UDP, assignee Faith_Zack, with a blank Reference column and no RFC cited. The IANA description field itself is simply the string "scohelp," with no elaborated protocol write-up in the registry.
Community and vendor documentation (not IANA) describes scohelp as the HTTP daemon SCO UnixWare (including UnixWare 7) shipped to serve manual pages and other system documentation through a web browser, running on this non-standard port separate from any general-purpose web server on the host.
Three CVEs document scohelp/UnixWare 7 vulnerabilities in the NVD. CVE-2000-1014, published 2000-12-11, is a format-string vulnerability in the search97.cgi CGI script reachable via the queryText parameter, allowing remote attackers to execute arbitrary commands. CVE-2000-0842, published 2000-11-14, is a separate directory-traversal issue in search97cgi/vtopic allowing remote attackers to read arbitrary files via a ".." attack. CVE-2000-0130, published 2000-01-27, is a buffer overflow in the SCO scohelp program allowing remote command execution. A Core Security Labs advisory referencing these issues returned an access error on fetch and could not be independently verified, so its advisory ID, date, and affected-user details are not asserted here.
Measured prevalence is near zero: the repo's port-data corpus (built from nmap-services) records an open-frequency of about 0.000013 for 457/tcp and 0.00061 for 457/udp, consistent with a service that has largely disappeared from production networks as SCO UnixWare itself was retired.
- IANA assignment
scohelp— description "scohelp"; reference column blank; assignee Faith_Zack; dual-registered 457/tcp + 457/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry scohelp 457/tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry scohelp 457/tcp
- Prevalence
- nmap-services open-frequency 457/tcp ≈ 0.000013 (~0.0013%); 457/udp ≈ 0.00061 (~0.061%) [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- neighboring registered-range legacy services (e.g. 1457/valisys-lm); contrast the small well-known-services cluster for comparison
Primary use
HTTP-based help/documentation server bundled with SCO UnixWare, serving man pages and system docs via a browser
Other/unofficial uses
none credibly reported beyond the SCO scohelp service in sources checked
Security implications
format-string RCE CVE-2000-1014 in search97.cgi via the queryText parameter (NVD, published 2000-12-11); separate directory-traversal CVE-2000-0842 in search97cgi/vtopic (NVD, published 2000-11-14); buffer overflow CVE-2000-0130 (NVD, published 2000-01-27); no malware/trojan association recorded as of August 2026 [Confirmed/Likely] — https://nvd.nist.gov/vuln/detail/CVE-2000-1014, https://nvd.nist.gov/vuln/detail/CVE-2000-0842, https://nvd.nist.gov/vuln/detail/CVE-2000-0130, https://www.auditmypc.com/tcp-port-457.asp, https://www.grc.com/port_457.htm
Typically seen on
legacy SCO UnixWare hosts; otherwise an anomaly on modern networks
- Analyst note
- An open port 457 today most likely reflects a retired or unpatched SCO UnixWare deployment rather than active mainstream use; treat as anomalous and investigate rather than assume benign.
About port 457/udp.
Port 457/udp carries scohelp, the SCO UnixWare/OpenServer online-documentation and help HTTP server; it is a legacy administrative service that should stay internal-only rather than exposed to the public internet.
IANA registers 457 as scohelp on both TCP and UDP, with the Reference field blank and assignee listed as [Faith_Zack]. No RFC or other formal specification defines a wire protocol — the registry entry documents only the service name and port assignment, not any message format.
In practice, third-party port-reference pages identify scohelp as the help/documentation HTTP server bundled with SCO's UnixWare 7 and OpenServer 5.x Unix distributions, letting administrators browse product documentation through a browser rather than through a formally specified protocol. One such page also describes it as usable, in principle, as a lightweight general-purpose web server, though no evidence surfaced of it being repurposed that way in practice.
NVD documents three scohelp/UnixWare 7 CVEs. CVE-2000-1014 (published 2000-12-11) is a format-string vulnerability in the search97.cgi CGI script via the queryText parameter, allowing remote attackers to execute arbitrary commands. CVE-2000-0842 (published 2000-11-14) is a separate directory-traversal vulnerability in search97cgi/vtopic allowing remote attackers to read arbitrary files via a ".." attack. CVE-2000-0130 (published 2000-01-27) is a buffer overflow in the SCO scohelp program allowing remote command execution. A Core Security Labs advisory referencing these issues returned an access error on fetch and could not be independently verified. No malware or trojan family is documented against this port.
- IANA assignment
scohelp— "scohelp"; reference (blank — no RFC cited); assignee[Faith_Zack]; dual-registered 457/tcp + 457/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry scohelp 457/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 457/udp ≈ 0.00061 (~0.061%); 457/tcp ≈ 0.000013 (negligible) [Confirmed] — this site's own tooling (nmap-services derived)
- Related ports
- none specifically paired with 457 was confirmed; nearest context is the generic well-known system range [Unknown]
Primary use
SCO UnixWare/OpenServer online-documentation HTTP server (scohelp daemon), reachable via browser for local product help
Other/unofficial uses
reportedly usable as a general lightweight web server per one third-party description; no confirmed instance of that use found
Security implications
format-string RCE CVE-2000-1014 in search97.cgi via the queryText parameter (NVD, published 2000-12-11); separate directory-traversal CVE-2000-0842 in search97cgi/vtopic (NVD, published 2000-11-14); buffer overflow CVE-2000-0130 (NVD, published 2000-01-27); no malware/trojan association recorded as of August 2026 [Confirmed] — https://nvd.nist.gov/vuln/detail/CVE-2000-1014, https://nvd.nist.gov/vuln/detail/CVE-2000-0842, https://nvd.nist.gov/vuln/detail/CVE-2000-0130, https://www.auditmypc.com/udp-port-457.asp
Typically seen on
legacy SCO UnixWare 7 / OpenServer 5.x Unix hosts
- Analyst note
- scohelp is a documentation/help service bundled with legacy SCO Unix products — an open 457/udp outside a legacy SCO environment is unusual and worth investigating rather than assumed to be routine traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| scohelp | UDP | — | 0.06% |
| scohelp | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.