CVE-1999-0706: High severity ISC inn vulnerability
Linux xmonisdn package allows local users to gain root privileges by modifying the IFS or PATH environmental variables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
xmonisdnfrom your environment.Uninstall the xmonisdn package if it is not required on the system.
- Configuration
Remove the setuid bit from any xmonisdn binaries (for example: chmod u-s /path/to/xmonisdn) so they do not execute with root privileges.
xmonisdn (binary) setuid = disabled - Configuration
Ensure any scripts or wrappers invoked by xmonisdn explicitly sanitize the environment by unsetting or setting IFS to a safe value and setting PATH to an absolute safe directory list before invoking external programs.
xmonisdn (scripts/wrappers) PATH, IFS handling = set to safe values / unset - Compensating control
Restrict execution and filesystem access to the xmonisdn binary to trusted administrative users (adjust filesystem permissions, use local policy or access controls) to reduce exposure to unprivileged local users.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0706?
CVE-1999-0706 is considered a high severity vulnerability due to the potential for local users to gain root privileges.
How do I fix CVE-1999-0706?
To fix CVE-1999-0706, it is recommended to restrict the permissions of the affected software and avoid allowing untrusted users to modify the IFS or PATH environment variables.
Which software is affected by CVE-1999-0706?
CVE-1999-0706 affects the ISC INN versions 1.5.1, 1.7, 1.7.2, 2.0, 2.1, 2.2 and Red Hat Linux versions 4.1, 4.2, 5.0, 5.1, 5.2, 6.0.
Who can exploit the CVE-1999-0706 vulnerability?
Local users with access to the environment variables can exploit the CVE-1999-0706 vulnerability.
What impact does CVE-1999-0706 have on systems?
The impact of CVE-1999-0706 can lead to unauthorized root access, resulting in potential system compromise.