CVE-1999-1168: High severity iss Internet Security Scanner vulnerability
install.iss installation script for Internet Security Scanner (ISS) for Linux, version 5.3, allows local users to change the permissions of arbitrary files via a symlink attack on a temporary file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ISS Internet Security Scanner (install.iss)from your environment.Do not use or distribute the vulnerable install.iss installation script. Remove or delete the install.iss installer from systems and avoid running it until a vendor-supplied fix is available; if the product is not required, uninstall the ISS software.
- Compensating control
Perform installations only from a secure administrative environment where unprivileged local users cannot create symlinks to the installer's temporary files (for example: run the installer in single-user mode or on an isolated system with no other local accounts).
- Operational
If the vulnerable installer was run on a multi-user system, inspect for and remediate unauthorized permission changes to files (restore from known-good backups or reinstall affected files) and audit the system for signs of misuse.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1168?
CVE-1999-1168 is considered a moderate severity vulnerability due to the potential for local users to exploit a symlink attack.
How do I fix CVE-1999-1168?
To mitigate CVE-1999-1168, ensure that the permissions and ownership of temporary files are properly configured to prevent unauthorized access.
What systems are affected by CVE-1999-1168?
CVE-1999-1168 affects version 5.3 of the ISS Internet Security Scanner installed on Linux systems.
Can CVE-1999-1168 be exploited remotely?
CVE-1999-1168 cannot be exploited remotely as it requires local user access.
What is a symlink attack in the context of CVE-1999-1168?
A symlink attack in CVE-1999-1168 allows a local user to create a symbolic link to modify the permissions of arbitrary files during the installation process.