CVE-1999-0959: High severity SGI IRIX vulnerability
IRIX startmidi program allows local users to modify arbitrary files via a symlink attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX startmidifrom your environment.Uninstall or remove the startmidi program if it is not required to eliminate the symlink exploitation vector.
- Configuration
Limit execution permissions for the startmidi binary so that unprivileged local users cannot run it (restrict execute bits or restrict to a specific administrative group).
SGI IRIX startmidi execution permissions = restrict execution to trusted/administrative users - Compensating control
Restrict local user privileges and file-system write access in locations that startmidi interacts with to prevent unprivileged users from creating symlinks or modifying files used by the program.
- Operational
Audit the system for unexpected or unauthorized file modifications that may have resulted from this issue, restore affected files from trusted backups, and investigate local user activity for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0959?
CVE-1999-0959 has a medium severity rating due to the potential for local users to exploit the symlink vulnerability to modify arbitrary files.
How do I fix CVE-1999-0959?
To fix CVE-1999-0959, ensure that the permissions for the 'startmidi' program are properly restricted to prevent unauthorized file modifications.
What systems are affected by CVE-1999-0959?
CVE-1999-0959 affects multiple versions of the SGI IRIX operating system, specifically versions 5, 6.0 through 6.4, including 6.0.1 and 6.1.
Who can exploit CVE-1999-0959?
CVE-1999-0959 can be exploited by local users who have access to the system and are able to create symlinks.
What type of vulnerability is CVE-1999-0959?
CVE-1999-0959 is a symlink vulnerability that allows local users to manipulate file permissions to gain unauthorized access to files.