CVE-1999-0712: Low severity Caldera COAS vulnerability
A vulnerability in Caldera Open Administration System (COAS) allows the /etc/shadow password file to be made world-readable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Caldera Open Administration System (COAS)from your environment.If COAS is not required, uninstall or decommission it from affected systems to eliminate the attack vector.
- Configuration
Ensure /etc/shadow is owned by root:root and set to mode 600 (e.g., chown root:root /etc/shadow && chmod 600 /etc/shadow) to prevent it from being world-readable.
/etc/shadow (Linux) file permissions and ownership = 600, owner: root, group: root - Compensating control
Until a vendor patch is available or the software is removed, isolate the affected host(s) (network segmentation) and restrict administrative/management access to trusted IPs (firewall/ACL) to reduce exposure.
- Operational
After restoring correct permissions, rotate all local account passwords and any credentials that may have been exposed via /etc/shadow.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0712?
CVE-1999-0712 has a high severity rating due to the potential exposure of sensitive password information.
How do I fix CVE-1999-0712?
To fix CVE-1999-0712, ensure that the /etc/shadow file permissions are securely set to restrict access.
Which versions of Caldera COAS are affected by CVE-1999-0712?
CVE-1999-0712 affects Caldera COAS versions 1.0.5, 1.0.6, and 1.0.7.
What impact does CVE-1999-0712 have on system security?
CVE-1999-0712 can allow unauthorized users to read the /etc/shadow file, compromising user accounts and system security.
Is there a patch available for CVE-1999-0712?
There is no specific patch for CVE-1999-0712, but adjusting file permissions is a necessary mitigation step.