CVE-1999-1022: Medium severity SGI IRIX vulnerability
serialports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, which allows local users to gain root privileges via a Trojan horse ls program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX serial_portsfrom your environment.Uninstall or disable the serial_ports administrative program if it is not required on the system.
- Configuration
Modify the serial_ports program (or install a wrapper) so it does not rely on the user's PATH when invoking external commands. Invoke ls by absolute path (for example /bin/ls) or clear/set PATH to a safe, trusted value before executing external programs; rebuild/redeploy the corrected binary.
serial_ports (IRIX) external command invocation / PATH handling = use absolute path or sanitize PATH - Configuration
If serial_ports does not require elevated privileges, remove the setuid root bit (e.g., chmod u-s /path/to/serial_ports) or otherwise reduce its privileges to prevent local privilege escalation.
serial_ports (IRIX) setuid bit / privileged execution = remove if not required - Compensating control
Ensure the PATH used by privileged/system programs contains only trusted directories and that those directories are not writable by unprivileged users. As a temporary mitigation, restrict write permissions on directories that appear early in PATH to prevent placement of Trojan executables.
- Operational
Search for and remove any Trojan or unexpected copies of ls (or other binaries) in directories that may appear in root/privileged PATH; verify integrity of system binaries and rebuild or restore any that are compromised.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1022?
CVE-1999-1022 has a high severity as it allows local users to gain root privileges on affected devices.
How do I fix CVE-1999-1022?
To fix CVE-1999-1022, ensure that the PATH environment variable is not misconfigured to include untrusted directories.
Which versions of IRIX are affected by CVE-1999-1022?
CVE-1999-1022 affects SGI IRIX versions 4.x and 5.x, specifically 4 and 5.2 to 5.3.
What type of vulnerability is CVE-1999-1022?
CVE-1999-1022 is a local privilege escalation vulnerability.
Can remote users exploit CVE-1999-1022?
No, CVE-1999-1022 can only be exploited by local users on the affected system.