CVE-1999-1145: High severity HPE HP-UX vulnerability
Vulnerability in Glance programs in GlancePlus for HP-UX 10.20 and earlier allows local users to access arbitrary files and gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
HPE/GlancePlus (Glance programs)from your environment.Uninstall or completely disable the Glance programs from GlancePlus on HP-UX systems (10.20 and earlier) if they are not required. Keep the component removed/disabled until a vendor-supplied fix is available.
- Configuration
Disable or stop the Glance programs/services to prevent execution on HP-UX 10.20 and earlier systems until a patch is provided by the vendor.
GlancePlus (Glance programs) enabled = false - Compensating control
Restrict local access to the affected Glance binaries: remove any setuid/setgid bits if present, tighten file permissions so unprivileged local users cannot execute them, and apply host-based access controls or isolate affected hosts from untrusted local accounts until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1145?
The severity of CVE-1999-1145 is considered high due to the potential for local users to access arbitrary files and escalate privileges.
How do I fix CVE-1999-1145?
To fix CVE-1999-1145, it is recommended to upgrade to a version of HP-UX that is not vulnerable, specifically versions later than 10.20.
Who is affected by CVE-1999-1145?
CVE-1999-1145 affects local users on HP-UX versions 10.20 and earlier, including versions 9, 10.01, and 10.10.
What are the potential impacts of CVE-1999-1145?
The potential impacts of CVE-1999-1145 include unauthorized access to sensitive files and privilege escalation for local users.
Is CVE-1999-1145 a remote attack vector?
No, CVE-1999-1145 is not a remote attack vector; it requires local access to the affected HP-UX systems.