CVE-1999-1185: Buffer Overflow
Buffer overflow in SCO mscreen allows local users to gain root privileges via a long terminal entry (TERM) in the .mscreenrc file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SCO mscreenfrom your environment.Uninstall mscreen from affected systems if it is not required to eliminate the vulnerable code path.
- Configuration
Remove the setuid root bit from the mscreen binary to prevent local privilege escalation (for example, run chmod u-s on the mscreen executable).
SCO mscreen executable setuid bit = remove - Configuration
Ensure users cannot create or modify .mscreenrc files that mscreen will parse; enforce file permissions or directory ACLs so only trusted accounts or root can write .mscreenrc in users' home directories.
.mscreenrc user configuration files file write permissions = restrict to owner/root only - Compensating control
Restrict who can execute mscreen (use filesystem permissions or ACLs to allow only trusted accounts) or otherwise restrict local user access to systems where mscreen is installed until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1185?
CVE-1999-1185 is considered a high-severity vulnerability due to its potential for local users to gain root privileges.
How do I fix CVE-1999-1185?
To fix CVE-1999-1185, you should update SCO mscreen to a patched version that addresses the buffer overflow issue.
Who is impacted by CVE-1999-1185?
Users of SCO cmw 3.0, SCO Internet FastStart, SCO Open Desktop 3.0, and Xinuos OpenServer 3.0 and 5.0 are impacted by CVE-1999-1185.
What causes the vulnerability in CVE-1999-1185?
CVE-1999-1185 is caused by a buffer overflow vulnerability when processing overly long terminal entries in the .mscreenrc file.
Can CVE-1999-1185 be exploited remotely?
No, CVE-1999-1185 can only be exploited by local users who have access to the affected system.