CVE-1999-0353: Critical severity HPE HP-UX vulnerability
rpc.pcnfsd in HP gives remote root access by changing the permissions on the main printer spool directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rpc.pcnfsdfrom your environment.If the rpc.pcnfsd service is not required, disable or uninstall rpc.pcnfsd on affected HP-UX systems to prevent remote root exploitation.
- Configuration
Change ownership and file-system permissions on the main printer spool directory so that unprivileged users (and rpc.pcnfsd) cannot modify or escalate privileges via that directory. Ensure only the appropriate system accounts (e.g., root and printer daemon accounts) have write access.
HP-UX main printer spool directory permissions = restrict to trusted/privileged users (prevent unprivileged modification) - Compensating control
Restrict network access to RPC/pcnfsd and the printer spool service from untrusted networks using firewall rules, ACLs, or network segmentation to limit exposure until a permanent fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0353?
CVE-1999-0353 is considered a critical vulnerability due to its potential for granting remote root access.
How do I fix CVE-1999-0353?
To fix CVE-1999-0353, you should update the rpc.pcnfsd to a patched version provided by HP for affected HP-UX versions.
Which versions of HP-UX are affected by CVE-1999-0353?
CVE-1999-0353 affects HP-UX versions 10.01, 10.10, 10.20, and 11.00.
What can attackers do exploiting CVE-1999-0353?
Exploiting CVE-1999-0353 allows attackers to gain remote root access to the affected HP-UX systems.
Is there a workaround for CVE-1999-0353?
A possible workaround for CVE-1999-0353 includes restricting access to the printer spool directory and disabling rpc.pcnfsd if not needed.