CVE-1999-0129: Medium severity Eric Allman Sendmail vulnerability
Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
sendmailfrom your environment.If sendmail is not required on the host, uninstall or remove the sendmail package to eliminate this attack vector.
- Configuration
Disable processing of .forward and :include files in sendmail's configuration so local users cannot create files that are interpreted by sendmail and cause it to gain group permissions.
Sendmail process .forward / :include files = disabled - Compensating control
Prevent untrusted local users from creating or modifying .forward or :include files and enforce filesystem permissions/ACLs so only trusted accounts may create files processed by sendmail; restrict write access to directories where sendmail will read included files.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0129?
CVE-1999-0129 is considered a high-severity vulnerability due to its potential to allow local users to escalate privileges.
How do I fix CVE-1999-0129?
To mitigate CVE-1999-0129, update your Sendmail version to 8.9 or later to eliminate the vulnerability.
Who is affected by CVE-1999-0129?
CVE-1999-0129 affects local users on systems running vulnerable versions of Sendmail, primarily versions 8.8.x.
What operating systems are impacted by CVE-1999-0129?
CVE-1999-0129 impacts various operating systems including BSDI, FreeBSD, HP-UX, AIX, SCO, and Solaris.
Can CVE-1999-0129 be exploited remotely?
CVE-1999-0129 cannot be exploited remotely as it requires local access to the affected system.