CVE-1999-1096: Buffer Overflow
Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
KDE Kde Beta 3 kscreensaver (klock)from your environment.Uninstall the vulnerable kscreensaver/klock package or remove the klock binary from affected systems until an official vendor patch is available.
- Configuration
If klock is installed and must remain, remove the setuid root permission from the klock binary (for example: chmod ug-s /path/to/klock) to prevent local users from gaining root privileges.
kscreensaver (klock) setuid bit = disabled - Compensating control
Restrict who can execute the klock binary using file permissions or local mandatory access controls (AppArmor/SELinux) and limit untrusted local user accounts to mitigate exploitation until a vendor fix is available.
- Operational
Audit systems for possible local compromise (review logs for unexpected privilege escalation, check for unauthorized root accounts or changes). If compromise is suspected, follow incident response procedures (isolate affected hosts, rebuild or restore from known-good images, and remediate before returning to service).
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1096?
CVE-1999-1096 is considered a high severity vulnerability due to the potential for local users to gain root privileges.
How do I fix CVE-1999-1096?
To remediate CVE-1999-1096, it is recommended to upgrade to a patched version of KDE that addresses this buffer overflow issue.
Who is affected by CVE-1999-1096?
CVE-1999-1096 primarily affects local users on systems running KDE version 1.0.
What type of vulnerability is CVE-1999-1096?
CVE-1999-1096 is categorized as a buffer overflow vulnerability.
Can CVE-1999-1096 be exploited remotely?
No, CVE-1999-1096 requires local access to the system to be exploited.