CVE-1999-1183: High severity SGI IRIX vulnerability
System Manager sysmgr GUI in SGI IRIX 6.4 and 6.3 allows remote attackers to execute commands by providing a trojan horse (1) runtask or (2) runexec descriptor file, which is used to execute a System Manager Task when the user's Mailcap entry supports the x-sgi-task or x-sgi-exec type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX System Manager (sysmgr) GUIfrom your environment.If the System Manager GUI is not required, uninstall or remove sysmgr to eliminate the vulnerable component from systems running SGI IRIX 6.3 or 6.4.
- Configuration
Edit users' ~/.mailcap and system /etc/mailcap and remove or comment out entries for 'x-sgi-task' and 'x-sgi-exec', or change their handlers so they do not execute System Manager tasks (e.g., open in a text viewer). Ensure mailcap will not automatically execute runtask or runexec descriptor files.
Mailcap (user and system mailcap entries) support for MIME types x-sgi-task and x-sgi-exec = disabled / removed - Compensating control
Filter or block incoming files and MIME types that could carry runtask/runexec descriptors (e.g., block x-sgi-task and x-sgi-exec content types and .runtask/.runexec attachments) at the mail gateway or proxy. Restrict remote access to the System Manager GUI to trusted IPs via firewall or network ACLs.
- Operational
Instruct users not to open or execute runtask or runexec descriptor files from untrusted sources. Audit systems for unexpected executions of System Manager tasks and review recent mailcap-invoked task executions.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1183?
CVE-1999-1183 is considered a critical vulnerability due to the potential for remote command execution.
How do I fix CVE-1999-1183?
To mitigate CVE-1999-1183, upgrade to a patched version of SGI IRIX that addresses this vulnerability.
What systems are affected by CVE-1999-1183?
CVE-1999-1183 affects SGI IRIX versions 6.3 and 6.4.
What type of attack is facilitated by CVE-1999-1183?
CVE-1999-1183 allows for remote command execution attacks by exploiting trojan horse descriptor files.
Is authentication required to exploit CVE-1999-1183?
No, CVE-1999-1183 can be exploited by remote attackers without requiring authentication.