CVE-1999-0038: Buffer Overflow
Buffer overflow in xlock program allows local users to execute commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
xlockfrom your environment.Uninstall the xlock program from affected systems if it is not required.
- Compensating control
Restrict untrusted local user access: disable or lock unused accounts, restrict interactive logins, and apply host-based access controls so unprivileged local users cannot reach or execute vulnerable binaries.
- Operational
Audit systems for signs of compromise (check logs, running processes, recent privilege escalations) and, if compromise is suspected, remediate and rotate any potentially exposed credentials/keys.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0038?
The severity of CVE-1999-0038 is considered high due to the potential for local users to execute arbitrary commands as root.
How do I fix CVE-1999-0038?
Fixing CVE-1999-0038 involves updating the xlock program to a version that does not contain this buffer overflow vulnerability.
What systems are affected by CVE-1999-0038?
CVE-1999-0038 affects various versions of Data General DG/UX, SGI IRIX, Debian GNU/Linux, HPE HP-UX, IBM AIX, and Oracle Solaris.
Who can exploit CVE-1999-0038?
CVE-1999-0038 can be exploited by local users with access to the affected systems.
Is there a patch available for CVE-1999-0038?
Yes, there are patches available for CVE-1999-0038, typically found with software updates for the affected systems.