CVE-1999-0420: High severity NetBSD Umapfs vulnerability
umapfs allows local users to gain root privileges by changing their uid through a malicious mountumap program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
umapfs (NetBSD)from your environment.If umapfs is not required, uninstall or remove the umapfs package and/or the mount_umap binary from systems to eliminate the vulnerable component.
- Configuration
Restrict execution of the mount_umap binary to root-only (remove execute permission for non-root users or move the binary to a root-only directory) so local unprivileged users cannot run a malicious mount_umap program.
mount_umap (umapfs) executable access = root-only - Compensating control
Prevent untrusted local users from mounting umapfs or from executing untrusted binaries — enforce host-based controls such as filesystem ACLs, mandatory access control policies, sudoers restrictions, or similar measures to block user execution of mount utilities.
- Operational
If a system may have been exploited, treat it as potentially fully compromised: isolate and reimage the host or reinstall from trusted media, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0420?
CVE-1999-0420 has a high severity rating as it allows local users to gain root privileges.
How do I fix CVE-1999-0420?
To mitigate CVE-1999-0420, ensure that the umapfs functionality is not enabled or apply relevant patches provided by the NetBSD project.
Who is affected by CVE-1999-0420?
CVE-1999-0420 affects users of NetBSD systems utilizing the umapfs feature.
Can CVE-1999-0420 be exploited remotely?
CVE-1999-0420 is a local privilege escalation vulnerability and cannot be exploited remotely.
What systems are vulnerable to CVE-1999-0420?
Systems running affected versions of NetBSD that utilize the umapfs file system are vulnerable to CVE-1999-0420.