CVE-1999-1242: Medium severity HPE HP-UX vulnerability
Vulnerability in subnetconfig in HP-UX 9.01 and 9.0 allows local users to gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
HP-UX subnetconfigfrom your environment.Uninstall or remove the subnetconfig utility from systems where it is not required.
- Configuration
Change ownership and permissions on the subnetconfig binary so only root or authorized administrators can execute it (for example, set owner to root and remove execute/read access for non-privileged users).
HP-UX subnetconfig file permissions / access = restrict execution to privileged users only (root/admin) - Compensating control
Restrict local user accounts and reduce the number of users with interactive login or shell access; apply host-based access controls or RBAC to prevent unprivileged local users from executing administrative utilities.
- Operational
Monitor HP vendor advisories for patches or fixed releases addressing subnetconfig on HP-UX and apply vendor-supplied updates immediately when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1242?
CVE-1999-1242 is considered a high severity vulnerability due to its capability to allow local users to gain elevated privileges on HP-UX systems.
How do I fix CVE-1999-1242?
To fix CVE-1999-1242, users should update their HP-UX systems to the latest patched version that addresses this vulnerability.
Who is affected by CVE-1999-1242?
CVE-1999-1242 affects local users on HP-UX versions 9.00 and 9.01 who can exploit the subnetconfig tool.
What type of vulnerability is CVE-1999-1242?
CVE-1999-1242 is a local privilege escalation vulnerability that occurs in the subnetconfig utility on HP-UX systems.
Is there a workaround for CVE-1999-1242?
While the best mitigation for CVE-1999-1242 is to apply patches, restricting access to the subnetconfig utility may serve as a temporary workaround.