CVE-1999-0661: Critical severity TCP Wrappers TCP Wrappers vulnerability
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail 8.12.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
OpenSSHfrom your environment.Uninstall the affected OpenSSH package if it is the affected release (e.g., OpenSSH 3.4p1). Do not trust the existing binaries; remove them before reinstalling a verified clean copy.
- Remove
Remove
Red Hat Sendmailfrom your environment.Uninstall the affected Sendmail package if it is the affected release (e.g., Sendmail 8.12.6). Remove compromised binaries prior to redeployment.
- Remove
Remove
TCP Wrappersfrom your environment.Uninstall the affected TCP Wrappers package if it is the affected release (e.g., TCP Wrappers 7.6). Remove compromised binaries prior to redeployment.
- Remove
Remove
Washington University wu-ftpdfrom your environment.Uninstall the affected wu-ftpd package if it is one of the affected releases (e.g., wuftpd 2.2 or 2.1f). Remove compromised binaries prior to redeployment.
- Remove
Remove
ircIIfrom your environment.Uninstall the affected ircII package if it is the affected release (e.g., ircII 2.2.9). Remove compromised binaries prior to redeployment.
- Remove
Remove
util-linuxfrom your environment.Uninstall the affected util-linux package if it is the affected release (e.g., util-linux 2.9g). Remove compromised binaries prior to redeployment.
- Compensating control
Isolate potentially affected hosts from the network (or restrict network access) until remediation is complete to prevent further compromise or data exfiltration.
- Operational
Reinstall affected software only from trusted, verified distribution points or known-good media. Verify checksums and cryptographic signatures of all replacement packages before installation. If system binaries were trojanized, consider a full system rebuild from trusted media.
- Operational
Conduct incident response activities: search for indicators of compromise, review logs for unauthorized access, and, if compromise is confirmed or suspected, rotate credentials and keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0661?
CVE-1999-0661 is considered a significant security vulnerability due to the risk of a Trojan Horse being distributed through compromised software.
How do I fix CVE-1999-0661?
To mitigate CVE-1999-0661, you should replace any affected software versions with legitimate updates from trusted sources.
Which software versions are affected by CVE-1999-0661?
CVE-1999-0661 affects versions of TCP Wrappers 7.6, util-linux 2.9g, wu-ftpd versions from 2.1f to 2.2, and various versions of IRC client ircII, OpenSSH, and Sendmail.
How can I determine if my system is vulnerable to CVE-1999-0661?
You can determine if your system is vulnerable to CVE-1999-0661 by checking the installed versions of the affected software against the known vulnerable versions.
What are the potential risks of CVE-1999-0661?
The potential risks of CVE-1999-0661 include unauthorized access to system resources and data exfiltration due to the presence of Trojan Horse software.