CVE-1999-0785: High severity ISC inn vulnerability
The INN inndstart program allows local users to gain root privileges via the "pathrun" parameter in the inn.conf file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or unset the "pathrun" parameter in inn.conf (for example delete the pathrun line or set it empty) so local users cannot leverage it to gain root privileges.
ISC INN (inndstart) pathrun = unset / remove - Compensating control
Restrict write access to inn.conf and executable permissions for inndstart to root/administrators only; ensure only trusted administrators can modify INN configuration or run inndstart until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0785?
CVE-1999-0785 is considered a high severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-0785?
To fix CVE-1999-0785, modify the inn.conf file to ensure the 'pathrun' parameter is set securely, preventing unauthorized access.
What types of systems are affected by CVE-1999-0785?
CVE-1999-0785 affects ISC INN versions 2.0, 2.1, and 2.2.
Can CVE-1999-0785 be exploited remotely?
No, CVE-1999-0785 can only be exploited by local users with access to the affected system.
Is there a patch available for CVE-1999-0785?
There is no specific patch for CVE-1999-0785, but users should upgrade to a later version of ISC INN that addresses this vulnerability.