CVE-1999-0818: Buffer Overflow
Buffer overflow in Solaris kcmsconfigure via a long NETPATH environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the NETPATH environment variable is not passed to or set for processes invoking kcms_configure. If NETPATH is required, validate and constrain its maximum length in any wrapper or launcher to prevent overly long values.
kcms_configure (Solaris) NETPATH environment variable = unset or limited length - Compensating control
Restrict who can execute kcms_configure: adjust filesystem permissions and local access controls so only trusted administrative accounts may run the binary. Prevent unprivileged or remote users from invoking it.
- Operational
Monitor Oracle/Solaris vendor advisories for an official patch or update addressing this buffer overflow and apply the vendor-supplied fix as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0818?
CVE-1999-0818 is classified as a high severity vulnerability due to the potential for remote code execution through a buffer overflow.
How do I mitigate the impact of CVE-1999-0818?
To mitigate CVE-1999-0818, limit the length of the NETPATH environmental variable or apply recommended patches from Oracle for affected Solaris versions.
Which versions of Solaris are affected by CVE-1999-0818?
CVE-1999-0818 affects Solaris 7.0 and SunOS 5.7.
Can CVE-1999-0818 be exploited remotely?
Yes, CVE-1999-0818 can be exploited remotely by an attacker to execute arbitrary code.
Is there a patch available for CVE-1999-0818?
Yes, patches are provided by Oracle and should be applied to vulnerable Solaris systems to address CVE-1999-0818.