CVE-1999-1088: High severity HPE HP-UX vulnerability
Vulnerability in chsh command in HP-UX 9.X through 10.20 allows local users to gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict local access to systems running HP-UX 9.x through 10.20 to trusted administrators only (limit who can log in locally, restrict console/physical access and unprivileged accounts).
- Compensating control
Until a vendor fix is available and applied, prevent exploitation of the vulnerable chsh command by removing or restricting non-root execution of the chsh utility (for example, remove setuid privileges or otherwise restrict execution to administrative accounts).
- Operational
Monitor system logs for use of the chsh command and other signs of local privilege escalation; investigate any suspicious activity and, if compromise is suspected, perform incident response actions such as credential rotation and system forensics.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1088?
CVE-1999-1088 has a high severity rating as it allows local users to gain elevated privileges on affected HP-UX systems.
How do I fix CVE-1999-1088?
To fix CVE-1999-1088, upgrade to a version of HP-UX that is not vulnerable, such as HP-UX 11.00 or later.
Who is affected by CVE-1999-1088?
Local users on HP-UX versions 9.x through 10.20 are affected by CVE-1999-1088.
What is the impact of CVE-1999-1088?
The impact of CVE-1999-1088 includes unauthorized privilege escalation which can lead to potential system compromise.
Is there a workaround for CVE-1999-1088?
A potential workaround for CVE-1999-1088 is to restrict access to the chsh command for non-administrative users.