CVE-1999-0828: Low severity SCO UnixWare vulnerability
UnixWare pkg commands such as pkginfo, pkgcat, and pkgparam allow local users to read arbitrary files via the dacread permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or disable the DAC read (dacread) permission for pkginfo, pkgcat, and pkgparam so local unprivileged users cannot use these commands to read arbitrary files. If disabling per-binary permissions is not possible, restrict execution of these commands to administrative accounts only.
Xinuos UnixWare pkg commands (pkginfo, pkgcat, pkgparam) dacread permission = disabled for unprivileged users - Compensating control
Restrict access to systems and local user accounts that can run pkginfo/pkgcat/pkgparam (e.g., limit shell access, apply sudoers rules or filesystem ACLs to permit execution only by trusted administrators) until a vendor patch or other permanent fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0828?
CVE-1999-0828 is classified as a security vulnerability that can lead to information disclosure.
How do I fix CVE-1999-0828?
To fix CVE-1999-0828, ensure that proper file permissions are set to restrict unauthorized access by local users.
Who is affected by CVE-1999-0828?
CVE-1999-0828 affects users of UnixWare versions 7.0 and 7.1, allowing potential unauthorized reading of files.
What type of systems are impacted by CVE-1999-0828?
UnixWare operating systems, specifically versions 7.0 and 7.1, are impacted by CVE-1999-0828.
Can remote users exploit CVE-1999-0828?
No, CVE-1999-0828 can only be exploited by local users with access to the affected UnixWare systems.