CVE-1999-0138: High severity Apple A Ux vulnerability
The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
suidperl/sperlfrom your environment.Uninstall or remove the suidperl and sperl programs if they are not required to eliminate the privilege-escalation vector.
- Configuration
Remove the setuid bit from the suidperl and sperl binaries so they do not run with elevated/root privileges (for example: chmod u-s /path/to/suidperl /path/to/sperl).
suidperl / sperl (setuid Perl binaries) setuid bit = removed - Compensating control
Until the affected binaries are fixed or removed, restrict execution to trusted administrators — e.g., move the binaries out of user PATHs and/or apply restrictive file permissions or ACLs to prevent non‑privileged users from executing them.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0138?
CVE-1999-0138 has a high severity rating due to the potential for unauthorized root access.
How do I fix CVE-1999-0138?
To fix CVE-1999-0138, you should update the affected software to the latest version that has patched this vulnerability.
Which systems are affected by CVE-1999-0138?
CVE-1999-0138 affects various systems including Apple A/UX, Digital OSF/1, FreeBSD, HPE HP-UX, and IBM AIX.
What are the risks of not addressing CVE-1999-0138?
Failing to address CVE-1999-0138 could lead to unauthorized root access, potentially allowing attackers to gain full control over affected systems.
Is CVE-1999-0138 still relevant today?
While CVE-1999-0138 is an older vulnerability, it remains relevant for legacy systems still in use that have not been updated.