CVE-1999-0133: Low severity Adobe FrameMaker vulnerability
fmfls license server for Adobe Framemaker allows local users to overwrite arbitrary files and gain root access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Adobe/FrameMaker fm_flsfrom your environment.Uninstall or disable the fm_fls license server component if it is not required on the host to eliminate the vulnerable service.
- Configuration
Configure the fm_fls service to run as a non-privileged (non-root) user to reduce impact of local exploitation.
fm_fls license server (Adobe FrameMaker) service user = non-root - Compensating control
Restrict local access and filesystem permissions for the fm_fls binary and its configuration/data directories so unprivileged local users cannot overwrite files (use filesystem permissions/ACLs, host-based access controls, and restrict execution to trusted administrative accounts).
- Operational
If exploitation is suspected, treat the host as potentially compromised: perform forensic investigation, rebuild or restore affected systems from known-good images, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0133?
CVE-1999-0133 has a high severity as it allows local users to gain root access through arbitrary file overwrites.
How do I fix CVE-1999-0133?
To fix CVE-1999-0133, ensure that you apply the latest security patches provided by Adobe for Framemaker.
Who is affected by CVE-1999-0133?
Local users of Adobe Framemaker are potentially affected by CVE-1999-0133 if they have access to the fm_fls license server.
What are the implications of CVE-1999-0133?
The implications of CVE-1999-0133 include unauthorized file access and the potential for system compromise by gaining root privileges.
Which versions of Adobe Framemaker are vulnerable to CVE-1999-0133?
All versions of Adobe Framemaker that utilize the fm_fls license server are vulnerable to CVE-1999-0133.