CVE-1999-0446: Low severity NetBSD NetBSD vulnerability
Local users can perform a denial of service in NetBSD 1.3.3 and earlier versions by creating an unusual symbolic link with the ln command, triggering a bug in VFS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or restrict execution of the ln binary for untrusted local users so they cannot create the specially-crafted symbolic link (for example, ensure ln is owned by root and not executable by unprivileged users).
/bin/ln (NetBSD ln command) executable permission / access = restrict execution to trusted/administrative accounts - Compensating control
Limit local account privileges and access: disable or remove unneeded local accounts, restrict which users can log in interactively, and apply filesystem ACLs or local policy to prevent untrusted users from creating symbolic links.
- Operational
Monitor NetBSD vendor/security advisories for a patch or fixed release addressing the VFS ln symlink DoS and apply the vendor-supplied fix when it becomes available.
Event History
Frequently Asked Questions
What is the vulnerability associated with CVE-1999-0446?
CVE-1999-0446 allows local users to perform a denial of service in NetBSD version 1.3.3 and earlier by creating an unusual symbolic link.
What are the affected versions listed under CVE-1999-0446?
The affected versions under CVE-1999-0446 include NetBSD 1.3.1, 1.3.2, and 1.3.3.
How can I mitigate the issue described in CVE-1999-0446?
Mitigation for CVE-1999-0446 involves upgrading to a version of NetBSD that is later than 1.3.3.
Is CVE-1999-0446 a remote or local vulnerability?
CVE-1999-0446 is classified as a local vulnerability, as it requires local user access to exploit.
What impact does CVE-1999-0446 have on system stability?
The impact of CVE-1999-0446 is a denial of service, which can cause instability in the affected NetBSD systems.