CVE-1999-1114: Buffer Overflow
Buffer overflow in Korn Shell (ksh) suidexec program on IRIX 6.x and earlier, and possibly other operating systems, allows local users to gain root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ksh (suid_exec)from your environment.If ksh (suid_exec) is not required, uninstall or remove the binary from the system.
- Configuration
Remove the setuid bit from the ksh suid_exec binary so it cannot be used for privilege escalation (e.g., run: chmod u-s <path-to-suid_exec> on the affected system).
Korn Shell (ksh) suid_exec setuid bit = removed - Compensating control
Restrict execution of the ksh suid_exec binary to trusted administrator accounts only using filesystem permissions or ACLs; prevent untrusted/local users from executing the binary.
- Operational
If exploitation is suspected, assume possible root compromise: audit system logs for unauthorized activity, restore affected systems from known-good backups, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1114?
CVE-1999-1114 is considered a high-severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-1114?
To fix CVE-1999-1114, users should update the Korn Shell (ksh) to a patched version that addresses the buffer overflow issue.
Which systems are affected by CVE-1999-1114?
CVE-1999-1114 affects IRIX 6.x and earlier versions, potentially impacting other operating systems as well.
Who is at risk from CVE-1999-1114?
Local users on vulnerable systems are at risk from CVE-1999-1114 as they can exploit the buffer overflow to gain elevated privileges.
Is CVE-1999-1114 still relevant today?
While CVE-1999-1114 primarily affects older systems, its existence highlights the importance of addressing buffer overflow vulnerabilities in modern software.