CVE-1999-0411: High severity SCO OpenServer vulnerability
Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p, including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a symlink attack, allowing a local user to gain root access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SCO OpenServer startup scripts: S84rpcinit, S95nis, S85tcp, S89nfsfrom your environment.If any of the listed startup scripts are not required on the system, uninstall or disable them to eliminate the vulnerable code paths (for example, remove or rename the init script or prevent it from being executed at boot).
- Configuration
Ensure each listed startup script is owned by root and remove write permission for group and others. For example, as root set ownership to root and remove write bits for group/other to prevent local users from creating symlinks that would be followed by these scripts.
S84rpcinit, S95nis, S85tcp, S89nfs startup scripts (SCO OpenServer) file_permissions_and_ownership = owned by root and not writable by unprivileged users - Compensating control
Prevent unprivileged users from creating or modifying files in directories used by init/startup processing (e.g., runlevel/init.d directories) and restrict local account creation. Restrict or harden local interactive access to reduce the chance a local user can exploit a symlink vulnerability.
- Operational
Audit the system for signs of local privilege escalation and symlink-based exploitation (check for unexpected root-owned processes, modified startup scripts, or newly created root artifacts). If compromise is suspected, perform incident response actions such as removing unauthorized accounts, rotating credentials, and rebuilding affected systems.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0411?
CVE-1999-0411 is considered a critical vulnerability as it allows local users to gain root access via a symlink attack.
How do I fix CVE-1999-0411?
To fix CVE-1999-0411, users should update their SCO OpenServer to a patched version that addresses the symlink vulnerability.
Which versions of SCO OpenServer are affected by CVE-1999-0411?
CVE-1999-0411 affects SCO OpenServer version 5.0.4p and earlier, as well as version 3.0.
What types of attacks are possible with CVE-1999-0411?
With CVE-1999-0411, a local user can perform a symlink attack to execute arbitrary code with root privileges.
Who can exploit CVE-1999-0411?
CVE-1999-0411 can be exploited by any local user with access to the affected startup scripts.