CVE-1999-0312: Medium severity HPE HP-UX vulnerability
HP ypbind allows attackers with root privileges to modify NIS data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
HPE HP-UX ypbindfrom your environment.If NIS/yp services are not required, uninstall or remove the ypbind component from affected systems.
- Configuration
Stop and disable the ypbind service on affected HP-UX systems until a vendor-supplied fix is available.
HPE HP-UX ypbind service_enabled = false - Compensating control
Restrict network access to hosts running ypbind/NIS to trusted management networks only (firewall/ACLs) and isolate NIS servers from untrusted networks to reduce exposure.
- Operational
Audit NIS data and system logs for unauthorized modifications and, if compromise is suspected, rotate any credentials, keys, or sensitive data stored in NIS after remediating or isolating affected systems.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0312?
The severity of CVE-1999-0312 is critical due to its potential to allow attackers with root privileges to modify NIS data.
How do I fix CVE-1999-0312?
To fix CVE-1999-0312, ensure that HP ypbind is updated to the latest version that mitigates this vulnerability.
Who is affected by CVE-1999-0312?
CVE-1999-0312 affects systems running HP-UX with the ypbind service enabled.
What are the risks associated with CVE-1999-0312?
The risks associated with CVE-1999-0312 include unauthorized modification of critical NIS data, potentially compromising the integrity of the network.
Can CVE-1999-0312 be exploited remotely?
Yes, CVE-1999-0312 can potentially be exploited remotely if an attacker gains access to the network where the vulnerable service is running.