CVE-1999-1197: High severity Sun SunOS vulnerability
TIOCCONS in SunOS 4.1.1 does not properly check the permissions of a user who tries to redirect console output and input, which could allow a local user to gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict access to the system console device by setting ownership to root and permissions to 0600 (e.g., chown root:root /dev/console; chmod 0600 /dev/console) to prevent non-root users from redirecting console input/output.
/dev/console permissions/ownership = owner=root, mode=0600 - Compensating control
Restrict local interactive logins and physical console access to trusted administrators only (disable or remove unneeded local accounts, enforce least-privilege accounts, and limit physical access) to reduce the risk that a local user can exploit TIOCCONS.
- Operational
Monitor audit logs for attempts to redirect console I/O or use TIOCCONS-like operations and investigate suspicious activity; if compromise is suspected, rotate any potentially exposed credentials and perform host integrity checks prior to restoring normal operations.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1197?
CVE-1999-1197 is considered a high-severity vulnerability due to its potential to allow privilege escalation for local users.
How do I fix CVE-1999-1197?
To fix CVE-1999-1197, ensure that access controls for the TIOCCONS interface are properly implemented to restrict unauthorized users.
Who is affected by CVE-1999-1197?
CVE-1999-1197 affects users running SunOS 4.1.1.
Can CVE-1999-1197 be exploited remotely?
CVE-1999-1197 cannot be exploited remotely as it requires local access to the affected system.
What impact does CVE-1999-1197 have on system security?
CVE-1999-1197 could allow local users to redirect console input and output, leading to unauthorized access to sensitive system information.