CVE-1999-1102: Low severity SGI IRIX vulnerability
lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
lprfrom your environment.If lpr is not required, uninstall or disable the lpr binary/daemon on affected systems to eliminate the local symlink exploitation vector.
- Configuration
Restrict execution of the lpr binary to trusted administrative accounts only (adjust filesystem permissions and ACLs so unprivileged local users cannot run lpr). Also ensure printing spool directories are not writable by unprivileged users.
lpr permissions/execution = root-only / administrative users only - Compensating control
Limit local account access and isolate systems that require printing services to trusted networks/users. Apply host-based controls (local firewall, mandatory access control, chroot/jail for printing service) to reduce the number of accounts that can invoke lpr.
- Operational
Search for and investigate unexpected file creations or overwrites (especially in privileged locations) caused by possible exploitation. Restore affected files from known-good backups and rotate any credentials, keys, or secrets that may have been exposed or modified.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1102?
CVE-1999-1102 is a vulnerability that allows local users to perform a symlink attack, potentially resulting in the creation or overwriting of arbitrary files.
How do I fix CVE-1999-1102?
To fix CVE-1999-1102, ensure that lpr is updated to a version that mitigates the symlink vulnerability or restrict access to lpr commands for non-privileged users.
Which operating systems are affected by CVE-1999-1102?
CVE-1999-1102 affects SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems.
Can CVE-1999-1102 be exploited remotely?
CVE-1999-1102 is a local vulnerability and cannot be exploited remotely, as it requires local user access.
What type of attack does CVE-1999-1102 facilitate?
CVE-1999-1102 facilitates a symlink attack, which can allow arbitrary file manipulation by local users.