CVE-1999-0782: Low severity FreeBSD FreeBSD vulnerability
KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
kde/kpppfrom your environment.Uninstall kppp if it is not required on the system to eliminate the vulnerable component.
- Configuration
Ensure kppp is launched with a sanitized environment so the HOME variable cannot be controlled by unprivileged users. Implement a wrapper or modify startup scripts to unset or set HOME to a safe directory before launching kppp, or apply an application-level change so kppp does not use the HOME environment variable for directory creation.
kppp (KDE) HOME environment variable handling = sanitize or ignore HOME - Compensating control
Restrict which local users can execute kppp (for example, remove execute permission for untrusted users, use filesystem ACLs, or group-based access controls) so unprivileged accounts cannot exploit the HOME-based directory creation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0782?
CVE-1999-0782 is classified as a local privilege escalation vulnerability.
How do I fix CVE-1999-0782?
To fix CVE-1999-0782, ensure that the HOME environmental variable does not allow users to create directories in arbitrary locations.
Who is affected by CVE-1999-0782?
CVE-1999-0782 affects local users of KDE kppp on systems including FreeBSD 6.2-stable and Linux Kernel 2.6.20.1.
What versions of KDE are vulnerable to CVE-1999-0782?
KDE version 1.0 is specifically vulnerable to CVE-1999-0782.
What potential impact does CVE-1999-0782 have?
The potential impact of CVE-1999-0782 includes unauthorized directory creation by local users, which can lead to further exploitation.