CVE-1999-0295: High severity Sun SunOS vulnerability
Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Oracle Solaris sysdeffrom your environment.If sysdef is not required, remove or uninstall the sysdef binary from affected systems to eliminate the ability for local users to read kernel memory.
- Configuration
Restrict the sysdef binary so only root can execute it (e.g., chown root:root /path/to/sysdef && chmod 700 /path/to/sysdef) to prevent local non-privileged users from running it.
sysdef command (Solaris) file_permissions = owner=root, permissions=0700 - Compensating control
Limit local account and administrative access: disable or remove unneeded local accounts, restrict who can obtain interactive shells, and apply the principle of least privilege so only trusted administrators can access affected systems.
- Operational
Audit systems for the presence and recent execution of sysdef, review logs for suspicious activity, and investigate any indications of compromise (including potential privilege escalation). If compromise is suspected, follow incident response procedures (containment, eradication, recovery).
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0295?
CVE-1999-0295 is classified as a high severity vulnerability due to potential unauthorized access to kernel memory.
How do I fix CVE-1999-0295?
To fix CVE-1999-0295, ensure that systems are updated to the latest security patches provided by Oracle.
What systems are affected by CVE-1999-0295?
CVE-1999-0295 affects several versions of Solaris and SunOS, specifically 5.3, 2.4, and other specified versions.
Can CVE-1999-0295 allow an attacker to gain root privileges?
Yes, CVE-1999-0295 can potentially allow local users to read kernel memory, which may lead to obtaining root privileges.
Is there a workaround for CVE-1999-0295?
The most effective workaround for CVE-1999-0295 is to limit access to the sysdef command or to apply the relevant security patches immediately.