CVE-1999-1023: Medium severity Sun SunOS vulnerability
useradd in Solaris 7.0 does not properly interpret certain date formats as specified in the "-e" (expiration date) argument, which could allow users to login after their accounts have expired.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use the useradd -e option to set account expiration dates on Solaris 7.0, because certain date formats may be misinterpreted. Set expirations by alternative administrative methods or refrain from relying on -e until a vendor fix is available.
useradd (Solaris 7.0) -e (expiration date) = avoid using -e / avoid certain date formats - Compensating control
Apply temporary access controls for affected systems until a vendor fix is available (for example, lock or remove login shells for accounts that should be expired, restrict authentication via PAM or network controls) to prevent logins from accounts that should be expired.
- Operational
Audit user accounts on Solaris 7.0 systems to find accounts with expiration dates and manually disable/lock any accounts that should have expired but remain active to prevent logins.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1023?
CVE-1999-1023 is classified as a medium severity vulnerability due to the potential for users to access expired accounts.
How do I fix CVE-1999-1023?
To fix CVE-1999-1023, ensure that the user accounts have correct expiration dates set and consider applying patches from the vendor that address this issue.
What systems are affected by CVE-1999-1023?
CVE-1999-1023 affects the Solaris 7.0 operating system, specifically SunOS version 5.7.
Can CVE-1999-1023 be exploited remotely?
CVE-1999-1023 requires local access to the system, so it cannot be exploited remotely.
What is the impact of CVE-1999-1023 if not mitigated?
If not mitigated, CVE-1999-1023 can allow unauthorized access to users whose accounts should have expired, posing a significant security risk.