CVE-1999-1210: High severity digital unix vulnerability
xterm in Digital UNIX 4.0B with patch kit 5 allows local users to overwrite arbitrary files via a symlink attack on a core dump file, which is created when xterm is called with a DISPLAY environmental variable set to a display that xterm cannot access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
xterm (Digital UNIX 4.0B with patch kit 5)from your environment.Uninstall or remove xterm from systems where it is not required, or restrict execution to trusted administrative accounts, to eliminate the vulnerable component.
- Configuration
Disable core dumps for local users or for processes that may invoke xterm (for example, set 'ulimit -c 0' in system shell startup files or in a wrapper used to launch xterm) to prevent creation of core dump files that could be abused.
system / user shell core dump settings core dump generation = disabled (ulimit -c 0) - Configuration
Ensure xterm is not started with DISPLAY set to a display it cannot access; clear or correct the DISPLAY environment variable before invoking xterm (for example, unset DISPLAY in user environments or wrappers when remote displays are not intended).
xterm invocation / environment DISPLAY environment variable = unset or set to an accessible display - Compensating control
Harden file-system directories where core dumps might be written (e.g., ensure restrictive ownership/permissions and disallow creation of arbitrary symlinks by unprivileged users) and limit local user privileges to reduce the risk of symlink-based overwrite attacks.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1210?
CVE-1999-1210 is considered a moderate severity vulnerability due to the potential for local users to exploit it.
How do I fix CVE-1999-1210?
To fix CVE-1999-1210, ensure that core dump file handling is secured to prevent symlink attacks.
Who is affected by CVE-1999-1210?
CVE-1999-1210 affects local users of Digital UNIX 4.0B with patch kit 5.
What kind of attack does CVE-1999-1210 involve?
CVE-1999-1210 involves a symlink attack that allows overwriting of arbitrary files.
What conditions trigger CVE-1999-1210?
CVE-1999-1210 is triggered when xterm is called with an inaccessible DISPLAY environment variable.