CVE-1999-0434: High severity Caldera OpenLinux vulnerability
XFree86 xfs command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
XFree86 xfsfrom your environment.Uninstall or remove the xfs command if it is not required on the system.
- Configuration
Restrict filesystem permissions/ACLs on the xfs binary so that only trusted administrative accounts can execute it (remove execute permission for non-privileged users).
XFree86 xfs executable_by_nonprivileged_users = false - Compensating control
Apply host-based access controls to limit impact: restrict local user access to affected hosts, and use mandatory access control (e.g., SELinux/AppArmor) or filesystem ACLs to prevent the xfs process or unprivileged users from creating or writing files in restricted directories.
- Operational
Audit systems for unexpected files in restricted directories and for execution of xfs; investigate and remove any malicious files. If signs of compromise are found, perform containment and recovery steps (for example, further forensic investigation and credential rotation as appropriate).
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0434?
CVE-1999-0434 is considered a moderate severity vulnerability due to its potential for privilege escalation and denial of service.
How do I fix CVE-1999-0434?
To fix CVE-1999-0434, update the affected version of the XFree86 server to a patched version provided by your operating system vendor.
Which systems are affected by CVE-1999-0434?
CVE-1999-0434 affects systems running specific versions of SCO OpenLinux, Debian Linux, NetBSD, Red Hat Linux, and SUSE Linux.
What type of attack does CVE-1999-0434 involve?
CVE-1999-0434 involves a symlink attack that allows local users to create files in restricted directories.
Can CVE-1999-0434 lead to privilege escalation?
Yes, CVE-1999-0434 can allow local users to gain elevated privileges on the system.