CVE-1999-1137: Low severity Sun Solaris vulnerability
The permissions for the /dev/audio device on Solaris 2.2 and earlier, and SunOS 4.1.x, allow any local user to read from the device, which could be used by an attacker to monitor conversations happening near a machine that has a microphone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the file permissions on /dev/audio to prevent non-privileged local users from reading the device (restrict read access to root or to a dedicated, trusted group).
Solaris and SunOS /dev/audio device device node permissions = remove read access for non-privileged local users
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1137?
CVE-1999-1137 is considered a moderate severity vulnerability due to the potential for local users to monitor audio via the /dev/audio device.
How do I fix CVE-1999-1137?
To fix CVE-1999-1137, it is recommended to change the permissions on the /dev/audio device to restrict access.
Who is affected by CVE-1999-1137?
CVE-1999-1137 affects local users on Solaris 2.2 and earlier, as well as SunOS 4.1.x systems.
What can an attacker do with CVE-1999-1137?
An attacker exploiting CVE-1999-1137 can potentially eavesdrop on conversations by accessing the /dev/audio device.
Is CVE-1999-1137 a remote exploit?
No, CVE-1999-1137 is a local exploit, meaning it requires access to the affected system to be exploited.