CVE-1999-1041: Buffer Overflow
Buffer overflow in mscreen on SCO OpenServer 5.0 and SCO UNIX 3.2v4 allows a local user to gain root access via (1) a long TERM environmental variable and (2) a long entry in the .mscreenrc file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
mscreen (SCO OpenServer / SCO UNIX)from your environment.Uninstall mscreen from affected systems (SCO OpenServer 5.0 and SCO UNIX 3.2v4) if the utility is not required.
- Configuration
Remove execute permission for non-privileged users (for example, via filesystem permissions or ACLs) so only trusted administrators can run mscreen, preventing local users from triggering the buffer overflow via a long TERM environment variable or a long .mscreenrc entry.
mscreen execute_permission = remove for non-privileged users - Compensating control
Restrict who can run or interact with mscreen and who can create or modify .mscreenrc files (use filesystem permissions, ACLs, or local account restrictions) to mitigate exploitation via long TERM environment variables or long .mscreenrc entries.
- Operational
If exploitation is suspected, investigate for signs of local privilege escalation, restore affected systems from known-good backups or rebuild as needed, and rotate any credentials or keys that may have been exposed before re-enabling mscreen.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1041?
CVE-1999-1041 is considered to have high severity due to its potential for local users to gain root access.
How do I fix CVE-1999-1041?
To fix CVE-1999-1041, ensure that the mscreen program is updated to a non-vulnerable version and restrict access to the system.
Who is affected by CVE-1999-1041?
CVE-1999-1041 affects users of SCO OpenServer 5.0 and SCO UNIX 3.2v4.
What causes CVE-1999-1041?
CVE-1999-1041 is caused by a buffer overflow vulnerability triggered by overly long input in the TERM environment variable and .mscreenrc file.
Can CVE-1999-1041 be exploited remotely?
CVE-1999-1041 cannot be exploited remotely as it requires local access to the affected system.