CVE-1999-1048: Buffer Overflow
Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove any use of the \w escape from PS1 so the prompt does not insert the current directory name. Configure prompts to use a static or safe format that does not expand directory names.
bash (PS1 environment variable) PS1 (\w option) = remove \w / do not include directory name in prompt - Operational
Locate and update PS1 definitions system-wide and per-user (for example in /etc/profile, /etc/bashrc, ~/.bashrc, ~/.bash_profile) to remove the \w option. Require users to re-login or reload their shell configuration so the safe prompt takes effect; audit user shells to ensure no remaining vulnerable PS1 settings exist.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1048?
CVE-1999-1048 is considered a high severity vulnerability due to its potential to allow local attackers to gain elevated privileges.
How do I fix CVE-1999-1048?
To fix CVE-1999-1048, update bash to a version that is not vulnerable to buffer overflow exploitation.
Which systems are affected by CVE-1999-1048?
CVE-1999-1048 affects bash versions 2.0.0, 1.4.17, and other versions on systems such as Debian 1.3.1 and Red Hat Linux 4.2.
What is the cause of CVE-1999-1048?
CVE-1999-1048 is caused by a buffer overflow that occurs when bash processes an oversized directory name through the PS1 environmental variable.
Can CVE-1999-1048 be exploited remotely?
CVE-1999-1048 cannot be exploited remotely; it requires local access to the vulnerable system.