CVE-1999-0906: Buffer Overflow
Buffer overflow in sccw allows local users to gain root access via the HOME environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
sccwfrom your environment.If sccw is not required on the system, uninstall or remove the sccw package to eliminate the vulnerable binary.
- Configuration
Ensure sccw is invoked with a sanitized environment: unset the HOME environment variable or set it to a trusted directory before starting sccw (especially when run with elevated privileges), so untrusted HOME contents cannot be used as an attack vector.
sccw HOME environment handling = unset or set to a trusted value - Compensating control
Restrict execution and access to the sccw binary to trusted administrators only (for example, adjust file permissions/ownership and local access controls so non-privileged users cannot execute it). Consider isolating or removing local user access to systems where sccw runs until an official patch is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0906?
CVE-1999-0906 has been classified as a critical vulnerability due to its ability to allow local users to gain root access.
How do I fix CVE-1999-0906?
To fix CVE-1999-0906, it is recommended to update or patch the affected version of SUSE Linux, specifically version 6.2.
Who is affected by CVE-1999-0906?
CVE-1999-0906 affects users of SUSE Linux version 6.2 who can execute the vulnerable sccw application.
What systems are specifically vulnerable to CVE-1999-0906?
CVE-1999-0906 specifically targets systems running SUSE Linux version 6.2.
Is there a workaround for CVE-1999-0906 if I can't patch immediately?
A potential workaround for CVE-1999-0906 is to restrict access to the sccw application or to avoid using it until a patch can be applied.