CVE-1999-1107: Buffer Overflow
Buffer overflow in kppp in KDE allows local users to gain root access via a long PATH environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
KDE/kpppfrom your environment.Uninstall the kppp package from affected systems if it is not required.
- Compensating control
Restrict which local users can execute kppp (for example, remove execute permission or use local ACLs) to prevent untrusted local users from running the vulnerable binary.
- Operational
Assume possible local root compromise due to this vulnerability: audit systems for unauthorized root activity, restore compromised hosts from known-good backups if needed, and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1107?
CVE-1999-1107 is classified as a high severity vulnerability due to the potential for local users to gain root access.
How does CVE-1999-1107 exploit a buffer overflow?
CVE-1999-1107 exploits a buffer overflow in kppp by creating a long PATH environmental variable that can overwrite critical memory.
What versions of KDE are affected by CVE-1999-1107?
CVE-1999-1107 affects KDE version 1.0.
How do I fix CVE-1999-1107?
To fix CVE-1999-1107, it is recommended to upgrade to a patched version of KDE that resolves the buffer overflow issue.
Can CVE-1999-1107 be mitigated without updating software?
Mitigation for CVE-1999-1107 without updating software is limited, but restricting user access to the affected system can help reduce risk.