CVE-1999-1266: Medium severity metamail corporation metamail vulnerability
rsh daemon (rshd) generates different error messages when a valid username is provided versus an invalid name, which allows remote attackers to determine valid users on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rshdfrom your environment.Uninstall or remove the rsh daemon from systems where it is not required.
- Configuration
Disable the rsh daemon/service on affected hosts to prevent remote user enumeration.
rsh daemon (rshd) enabled = false - Configuration
Configure rshd (or its PAM/authentication layer) to return identical, non‑disclosing error messages for authentication failures so valid usernames cannot be distinguished from invalid ones.
rsh daemon (rshd) user_error_messages = generic - Compensating control
Restrict access to the rsh service to trusted hosts or networks using firewall rules, ACLs, or network segmentation until the issue is mitigated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1266?
The severity of CVE-1999-1266 is considered medium as it allows attackers to enumerate valid usernames on the system.
How do I fix CVE-1999-1266?
To fix CVE-1999-1266, you should disable or restrict access to the rsh daemon and consider using more secure alternatives like ssh.
What systems are affected by CVE-1999-1266?
CVE-1999-1266 affects systems running the rsh daemon, including versions of Metamail up to 7.2.
What is the impact of CVE-1999-1266?
The impact of CVE-1999-1266 is that it can lead to unauthorized users gaining knowledge of valid usernames, assisting in further attacks.
Is CVE-1999-1266 still a concern today?
While CVE-1999-1266 originated in 1999, systems using outdated software that still employs the rsh daemon remain at risk.