CVE-1999-0732: Low severity Debian Debian Linux vulnerability
The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
debian/smtp-refuserfrom your environment.Uninstall the smtp-refuser package if it is not required to eliminate the vulnerable logging facility.
- Configuration
Disable smtp-refuser's logging facility if possible. If logging must remain enabled, configure log file locations and permissions so that unprivileged local users cannot create or replace log files or create symbolic links into sensitive locations (ensure log directories and files are owned by a privileged account and are not writable by local users).
Debian smtp-refuser logging facility = disabled or restricted - Compensating control
Restrict local user write access to the directories used for smtp-refuser logging (prevent unprivileged users from creating symlinks in those directories) and apply host-level protections (file permissions, ACLs, or mandatory access control) to prevent arbitrary file deletion via symbolic links.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0732?
CVE-1999-0732 has a medium severity rating due to its potential to allow local users to delete arbitrary files.
How do I fix CVE-1999-0732?
To fix CVE-1999-0732, you should update the Debian smtp-refuser package to a version that addresses this vulnerability.
Who is affected by CVE-1999-0732?
CVE-1999-0732 affects users of the Debian GNU/Linux 4.0 operating system running the smtp-refuser package.
What systems are vulnerable to CVE-1999-0732?
Any system running Debian GNU/Linux version 4.0 with the smtp-refuser package installed is vulnerable to CVE-1999-0732.
What is the impact of CVE-1999-0732?
The impact of CVE-1999-0732 allows local users to manipulate symbolic links, potentially leading to file deletion.