CVE-1999-0502: High severity Sun SunOS vulnerability
A Unix account has a default, null, blank, or missing password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
unix/accountfrom your environment.If the account is not required for operation, remove the account from the system (for example using userdel or the platform-equivalent account removal method).
- Configuration
Set a non-empty, strong password for the affected account using the system's password management utilities (e.g., passwd or equivalent) so the account does not have a default, null, blank, or missing password.
Unix account (HPE HP-UX, Oracle Solaris/ZFS, Red Hat Linux, SunOS) password = non-empty strong password - Configuration
Temporarily lock or disable the account and/or set its login shell to a non-interactive shell (for example nologin/false or the platform equivalent) until the account is reviewed and a proper password is set.
Unix account (HPE HP-UX, Oracle Solaris/ZFS, Red Hat Linux, SunOS) account_enabled/login_shell = disabled or non-interactive shell - Compensating control
Until accounts are corrected, restrict access to the affected hosts and services (firewall rules, ACLs, service allowlists) to trusted IPs and administrators to reduce risk of unauthorized access.
- Operational
Perform a system-wide audit to identify any accounts with default/null/blank/missing passwords, rotate credentials for impacted accounts, and review account privileges (including sudoers) to ensure least privilege.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0502?
CVE-1999-0502 is considered a critical vulnerability due to the potential for unauthorized access on systems with default or blank passwords.
How do I fix CVE-1999-0502?
To fix CVE-1999-0502, ensure that all Unix accounts have strong, non-blank passwords set and implement policies for regular password updates.
What systems are affected by CVE-1999-0502?
CVE-1999-0502 affects various versions of HP-UX, Red Hat Linux, and SunOS as listed in the vulnerability details.
Can CVE-1999-0502 be exploited remotely?
Yes, CVE-1999-0502 can be exploited remotely if attackers have access to the login prompt of the affected systems.
What are the potential consequences of CVE-1999-0502 exploitation?
Exploitation of CVE-1999-0502 can lead to complete system compromise, allowing attackers to execute arbitrary commands and access sensitive data.