CVE-1999-0942: High severity SCO UnixWare vulnerability
UnixWare dos7utils allows a local user to gain root privileges by using the STATICMERGE environmental variable to find a script which it executes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Xinuos UnixWare/dos7utilsfrom your environment.If dos7utils is not required, uninstall or remove the package from affected systems to eliminate the vulnerable functionality.
- Configuration
Ensure the STATICMERGE environment variable is not present or used when invoking dos7utils. Remove or clear STATICMERGE from system-wide and per-user shell startup files (e.g., /etc/profile, ~/.profile) so untrusted users cannot influence script lookup.
dos7utils STATICMERGE environment variable = unset / not used - Compensating control
Restrict execution of the dos7utils binary to trusted administrators only (for example, remove execute permission for unprivileged users or otherwise limit which accounts can run it) until an official fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0942?
CVE-1999-0942 is classified as a high severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-0942?
To fix CVE-1999-0942, it is recommended to remove or restrict the use of the STATICMERGE environmental variable in UnixWare 7.1.
What versions of UnixWare are affected by CVE-1999-0942?
CVE-1999-0942 specifically affects UnixWare version 7.1.
Can CVE-1999-0942 be exploited remotely?
CVE-1999-0942 cannot be exploited remotely as it requires local access to the system.
What are the consequences of exploiting CVE-1999-0942?
Exploiting CVE-1999-0942 can lead to unauthorized root access, compromising the entire UnixWare system.