CVE-1999-1205: Low severity HPE HP-UX vulnerability
nettune in HP-UX 10.01 and 10.00 is installed setuid root, which allows local users to cause a denial of service by modifying critical networking configuration information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
HPE HP-UX nettunefrom your environment.Uninstall or remove the nettune utility if it is not required on the system to eliminate the vulnerability allowing local users to modify networking configuration.
- Configuration
Remove the setuid-root permission from the nettune binary so it no longer runs with root privileges (for example, run: chmod u-s /path/to/nettune using the correct binary path on the HP-UX system).
nettune (HP-UX) setuid bit = removed - Compensating control
Restrict execution of the nettune binary to trusted administrative accounts only via filesystem permissions or ACLs; limit local user accounts that can log in to the system to reduce risk until nettune is removed or its setuid bit is cleared.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1205?
CVE-1999-1205 is considered a high severity vulnerability due to its potential for local users to cause denial of service on affected systems.
How do I fix CVE-1999-1205?
To fix CVE-1999-1205, you should remove the setuid bit from the nettune executable or upgrade to a secure version of HP-UX.
Which versions of HP-UX are affected by CVE-1999-1205?
CVE-1999-1205 affects HP-UX versions 10.00 and 10.01.
What are the potential impacts of CVE-1999-1205?
The potential impacts of CVE-1999-1205 include unauthorized modification of critical networking configuration and service disruptions.
Who is mainly at risk from CVE-1999-1205?
Local users on systems running vulnerable versions of HP-UX are mainly at risk from CVE-1999-1205.