CVE-1999-0023: Buffer Overflow
Local user gains root privileges via buffer overflow in rdist, via lookup() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rdistfrom your environment.Uninstall rdist from affected systems if it is not required.
- Configuration
Remove the setuid/root privilege from the rdist binary so it cannot run with root privileges (e.g., chmod u-s <rdist-binary>), or otherwise prevent rdist from executing as root.
rdist setuid/root execution = remove - Compensating control
Restrict which local accounts can execute rdist or run it only from isolated/trusted administrative hosts; alternatively confine rdist with application sandboxing (AppArmor/SELinux) or other host-based controls to limit impact if exploited.
- Operational
If exploitation is suspected, assume possible full compromise: perform incident response (collect logs, detect unauthorized changes), restore affected systems from known-good backups, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0023?
CVE-1999-0023 is classified as a high severity vulnerability due to the potential for local users to gain root privileges.
How do I fix CVE-1999-0023?
To fix CVE-1999-0023, you should apply security patches provided by your software vendor for the affected versions of inet, FreeBSD, AIX, SCO, or SunOS.
Who is affected by CVE-1999-0023?
CVE-1999-0023 affects local users on systems running specific versions of inet, FreeBSD, AIX, SCO Internet FastStart, and SunOS.
What systems are vulnerable to CVE-1999-0023?
Systems vulnerable to CVE-1999-0023 include inet versions 5.01 and 6.01, various FreeBSD versions, AIX versions 3.2 to 4.2, and several versions of SCO and SunOS.
What is the nature of the vulnerability outlined in CVE-1999-0023?
CVE-1999-0023 is a buffer overflow vulnerability in the rdist lookup() function that allows local users to execute code with elevated privileges.