CVE-1999-0062: High severity OpenBSD OpenBSD vulnerability
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
openbsd/chpassfrom your environment.Disable or remove the chpass utility until an official fix is available. For example, revoke execute permissions or rename/remove the chpass binary to prevent local users from invoking it.
- Compensating control
Restrict or isolate untrusted local accounts and prevent them from running administrative utilities. Implement local access controls (file permissions, sudoers restrictions, or similar) to block execution of chpass by non-administrative users until a vendor patch is applied.
- Operational
Audit system logs for signs of local privilege escalation and investigate any suspicious root access. If compromise is suspected, assume root access and perform incident response actions such as isolating affected hosts and rotating credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0062?
CVE-1999-0062 is considered a critical vulnerability due to the potential for local users to gain root access.
How do I fix CVE-1999-0062?
To mitigate CVE-1999-0062, it is recommended to update to a patched version of OpenBSD that addresses this issue.
What does CVE-1999-0062 exploit?
CVE-1999-0062 exploits file descriptor leakage in the chpass command on OpenBSD.
Who is affected by CVE-1999-0062?
Local users on OpenBSD version 2.3 are at risk from CVE-1999-0062.
When was CVE-1999-0062 disclosed?
CVE-1999-0062 was disclosed in 1999, highlighting a significant security concern in OpenBSD.