CVE-1999-1244: High severity darren reed ipfilter vulnerability
IPFilter 3.2.3 through 3.2.10 allows local users to modify arbitrary files via a symlink attack on the saved output file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
phildev/ipfilterfrom your environment.Uninstall Phildev IPFilter if it is not required or remove the affected installation until a fixed version is available.
- Compensating control
Restrict write access to the directory where IPFilter saves its output so unprivileged local users cannot create symlinks there (ensure only trusted/administrative accounts can write to that location).
- Compensating control
Limit local user accounts and apply least-privilege on hosts running IPFilter (remove or restrict untrusted local accounts to prevent local exploitation).
- Operational
If compromise is suspected, scan for unexpected symlinks and signs of file modification under directories IPFilter writes to, restore altered files from known-good backups, and investigate local account activity.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1244?
CVE-1999-1244 is classified as a moderate severity vulnerability due to its potential for local users to modify arbitrary files.
How do I fix CVE-1999-1244?
To fix CVE-1999-1244, you should upgrade IPFilter to a version that is not vulnerable, such as 3.2.11 or later.
Which versions of IPFilter are affected by CVE-1999-1244?
CVE-1999-1244 affects IPFilter versions 3.2.3 through 3.2.10.
What type of attack does CVE-1999-1244 involve?
CVE-1999-1244 involves a symlink attack that allows local users to overwrite files.
Can CVE-1999-1244 be exploited remotely?
CVE-1999-1244 cannot be exploited remotely as it requires local user access to the system.