CVE-1999-1232: High severity SGI IRIX vulnerability
Untrusted search path vulnerability in day5datacopier in SGI IRIX 6.2 allows local users to execute arbitrary commands via a modified PATH environment variable that points to a malicious cp program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
day5datacopier (SGI IRIX 6.2)from your environment.Uninstall or remove the day5datacopier program if it is not required.
- Configuration
Modify day5datacopier so it invokes the cp utility using an absolute path (for example /bin/cp) and/or sanitize/reset the PATH environment variable to a safe value that excludes user-writable directories before executing external commands.
day5datacopier (SGI IRIX 6.2) external command invocation / PATH handling = use absolute path for cp and sanitize PATH - Compensating control
Restrict which local accounts can execute day5datacopier by adjusting file permissions or ACLs so only trusted users can run it. If immediate code changes are not possible, prevent untrusted local users from running the binary.
- Operational
Investigate for signs of exploitation: check PATH directories and system locations for malicious 'cp' binaries or other unauthorized files, remove any discovered malicious binaries, and perform appropriate incident response (including further system integrity checks). If compromise is suspected, take additional remediation such as credential rotation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1232?
CVE-1999-1232 has a medium severity level, as it allows local users to execute arbitrary commands.
How do I fix CVE-1999-1232?
To fix CVE-1999-1232, ensure that the PATH environment variable does not include untrusted directories.
Who is affected by CVE-1999-1232?
Local users of SGI IRIX version 6.2 are affected by CVE-1999-1232.
What type of vulnerability is CVE-1999-1232?
CVE-1999-1232 is an untrusted search path vulnerability.
Can CVE-1999-1232 be exploited remotely?
CVE-1999-1232 cannot be exploited remotely as it requires local access to the vulnerable system.