CVE-1999-1227: High severity Ethereal Group Ethereal vulnerability
Ethereal allows local users to overwrite arbitrary files via a symlink attack on the packet capture file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Etherealfrom your environment.If Ethereal is not required, uninstall or remove the Ethereal package to eliminate the vulnerability until an official fix is available.
- Configuration
Ensure Ethereal writes packet capture files only to locations that are not writable by unprivileged or untrusted local users (adjust directory ownership and permissions, use a dedicated capture directory accessible only to trusted accounts) to prevent symlink-based overwrites.
Ethereal packet capture file directory writability = not writable by unprivileged/local users - Compensating control
Restrict which local accounts can execute Ethereal and create capture files (use OS-level user/group restrictions, access control lists, sandboxing, or application whitelisting) so untrusted local users cannot create capture files or symlinks that lead to arbitrary file overwrite.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1227?
CVE-1999-1227 is considered a medium severity vulnerability due to the potential for local users to exploit it.
How do I fix CVE-1999-1227?
To fix CVE-1999-1227, ensure that file permissions are correctly configured to prevent symlink attacks on the packet capture file.
Who is affected by CVE-1999-1227?
Local users with access to the Ethereal application are affected by CVE-1999-1227.
What types of attacks can be executed using CVE-1999-1227?
CVE-1999-1227 can be exploited through a symlink attack to overwrite arbitrary files.
Is there a patch available for CVE-1999-1227?
Check the Ethereal release notes for any updates or patches that address CVE-1999-1227.