CVE-1999-0421: High severity Slackware Slackware Linux vulnerability
During a reboot after an installation of Linux Slackware 3.6, a remote attacker can obtain root access by logging in to the root account without a password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Immediately set a secure, non-empty password for the root account on any system installed with Slackware Linux 3.6. Do not leave the root account without a password.
Slackware Linux (root account) root_password = non-empty strong password - Configuration
Disable remote root logins until a secure root password has been configured (prevent remote login as root without a password).
remote login/authentication permit_root_login = disabled until root has password - Compensating control
Restrict or block remote access to systems installed with Slackware Linux 3.6 (for example via firewall rules, network ACLs or isolating the hosts) until the root account has been secured to prevent remote attackers from logging in without a password.
- Operational
Audit all installations of Slackware Linux 3.6 to identify systems where the root account has no password; for each affected system, set a root password or disable remote root login and verify the issue is resolved.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0421?
CVE-1999-0421 is considered critical as it allows remote attackers to gain root access without a password.
How do I fix CVE-1999-0421?
To fix CVE-1999-0421, ensure that the root account is secured with a password and consider applying updates or patches provided by Slackware.
Which versions are affected by CVE-1999-0421?
CVE-1999-0421 specifically affects Slackware Linux version 3.6.
Can CVE-1999-0421 be exploited remotely?
Yes, CVE-1999-0421 can be exploited remotely by attackers who can log in to the root account without a password.
What are the implications of CVE-1999-0421?
The implications of CVE-1999-0421 include complete system control by unauthorized users, potentially leading to data breaches and system compromise.