CVE-1999-0358: Buffer Overflow
Digital Unix 4.0 has a buffer overflow in the inc program of the mh package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
mh (inc program)from your environment.If the mh package (or specifically the 'inc' program) is not required on affected systems, uninstall the mh package or remove the 'inc' binary to eliminate the vulnerable component.
- Configuration
Prevent execution of the 'inc' binary until a vendor fix is available by removing its execute permission or otherwise disabling the program (for example, revoke execute bits or replace the binary with a harmless stub).
mh (inc program) executable permission = disabled (remove execute permission) - Compensating control
Restrict access to hosts and accounts that can run the 'inc' program (for example, limit user accounts, restrict interactive shells, or apply access controls) and monitor for attempts to execute 'inc' until an official fix is provided.
- Operational
Audit all systems to locate any installed 'inc' binaries from the mh package, remove or disable any found instances, and isolate or remediate affected hosts. Apply vendor-provided fixes when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0358?
CVE-1999-0358 is considered a moderate severity vulnerability due to the risk of buffer overflow, which could allow an attacker to execute arbitrary code.
How do I fix CVE-1999-0358?
To fix CVE-1999-0358, you should apply updates or patches provided by Digital for the affected versions of Digital Unix.
Which versions of Digital Unix are affected by CVE-1999-0358?
CVE-1999-0358 affects Digital Unix versions 4.0, 4.0a, 4.0b, 4.0c, 4.0d, and 4.0e.
What is the impact of CVE-1999-0358?
The impact of CVE-1999-0358 can lead to unauthorized execution of code, which may compromise system integrity.
How can I identify if my system is vulnerable to CVE-1999-0358?
To identify if your system is vulnerable to CVE-1999-0358, you should check the version of Digital Unix in use and assess if it is one of the affected versions.