CVE-1999-0113: Critical severity IBM AIX vulnerability
Some implementations of rlogin allow root access if given a -froot parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
IBM AIX rloginfrom your environment.Uninstall or remove the rlogin client/server binaries from systems where rlogin is not required.
- Configuration
Disable the rlogin service on affected AIX systems to prevent root access via the -froot parameter.
rlogin (IBM AIX) rlogin_service_enabled = false - Compensating control
Restrict or block access to rlogin from untrusted networks/hosts using firewall rules, TCP wrappers (hosts.allow/hosts.deny), or other network access controls until the vulnerability is mitigated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0113?
CVE-1999-0113 is classified as a high severity vulnerability due to the potential for unauthorized root access.
How do I fix CVE-1999-0113?
To fix CVE-1999-0113, ensure that the rlogin command does not allow the -froot parameter or restrict its use.
Which versions of IBM AIX are affected by CVE-1999-0113?
Versions 3.1, 3.2, 3.2.4, and 3.2.5 of IBM AIX are affected by CVE-1999-0113.
What impact does CVE-1999-0113 have on system security?
CVE-1999-0113 can allow attackers to gain root access, compromising the security and integrity of the system.
Is there a workaround for CVE-1999-0113?
A workaround for CVE-1999-0113 includes disabling the rlogin service altogether or replacing it with more secure alternatives.