CVE-1999-0130: High severity Eric Allman Sendmail vulnerability
Local users can start Sendmail in daemon mode and gain root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
sendmailfrom your environment.Uninstall Sendmail if it is not required on the system to eliminate the risk of local users starting the daemon and gaining root privileges.
- Configuration
Prevent local (non-root) users from starting Sendmail in daemon mode. Configure Sendmail and system service controls so only root may start the daemon or disable daemon mode entirely if not required.
Sendmail daemon mode = disabled for non-privileged users - Compensating control
Restrict execution and startup of the Sendmail binary to trusted administrators (for example, set ownership to root and remove execute permission for other users, apply file ACLs, or restrict via sudoers/SELinux/AppArmor policies) to prevent local users from launching the daemon.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0130?
CVE-1999-0130 is considered a high severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-0130?
To mitigate CVE-1999-0130, users should upgrade to a patched version of Sendmail that resolves this exploit.
Which versions of Sendmail are affected by CVE-1999-0130?
CVE-1999-0130 affects versions 8.7, 8.8, 8.8.1, and 8.8.2 of Sendmail.
Can CVE-1999-0130 be exploited remotely?
CVE-1999-0130 requires local access to the system, making it a local privilege escalation vulnerability.
What systems are affected by CVE-1999-0130?
CVE-1999-0130 impacts multiple systems including Caldera Network Desktop, FreeBSD, HP-UX, and various Linux distributions.