CVE-1999-0380: Medium severity Seattle Lab Software Slmail vulnerability
SLMail 3.1 and 3.2 allows local users to access any file in the NTFS file system when the Remote Administration Service (RAS) is enabled by setting a user's Finger File to point to the target file, then running finger on the user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Remote Administration Service (RAS) in SLMail to prevent local users from leveraging the Finger File to read arbitrary NTFS files.
SLMail Remote Administration Service (RAS) Remote Administration Service (RAS) = disabled - Configuration
Disable the finger feature or configure SLMail to disallow users from setting a user's Finger File to arbitrary filesystem paths; if disabling is not possible, restrict the ability to set or change Finger File paths to trusted administrators only.
SLMail (finger/Finger File) Finger File usage = disabled or restricted - Compensating control
Restrict access to SLMail management/administration interfaces and the system accounts that can enable RAS to trusted administrators only (network ACLs, host-based firewall, or separate management network) to reduce the risk while a configuration fix is applied.
- Operational
Audit all user Finger File entries on affected SLMail installations and remove or reset any entries that point to sensitive NTFS files; review recent accesses to determine if sensitive files were exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0380?
CVE-1999-0380 has a high severity rating due to its potential for local users to access sensitive files on an NTFS file system.
How do I fix CVE-1999-0380?
To fix CVE-1999-0380, disable the Remote Administration Service in SLMail or upgrade to a patched version.
Who is affected by CVE-1999-0380?
CVE-1999-0380 affects local users of SLMail versions 3.1 and 3.2 when the Remote Administration Service is enabled.
What are the potential impacts of CVE-1999-0380?
The potential impacts of CVE-1999-0380 include unauthorized access to confidential files and data exposure.
How does the exploit in CVE-1999-0380 work?
The exploit in CVE-1999-0380 allows a user to manipulate their Finger File to gain access to any file on the NTFS file system.