CVE-1999-1288: Medium severity samba samba vulnerability
Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions including the setgid bit, which allows local users to read and write files and possibly gain privileges via bugs in the program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
samba/wsmbconffrom your environment.If wsmbconf is not required, uninstall or delete the prototype wsmbconf application/binary to eliminate the vulnerable program installed with incorrect permissions.
- Configuration
Remove the setgid bit from the installed wsmbconf binary and tighten its filesystem permissions so non-privileged local users cannot read or write the file (e.g., clear the setgid flag and restrict group/other permissions).
wsmbconf (installed by Samba 1.9.18) file permissions (setgid bit) = setgid removed; restrict read/write to privileged users - Operational
Audit affected systems for signs of local exploitation or unauthorized file access/modification related to wsmbconf. If evidence of compromise is found, follow incident response procedures to contain and remediate the impact.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1288?
CVE-1999-1288 has a high severity due to the potential for local users to exploit incorrect file permissions and gain elevated privileges.
How do I fix CVE-1999-1288?
To fix CVE-1999-1288, you should remove the setgid bit from the wsmbconf application and ensure proper file permissions.
What versions of Samba are affected by CVE-1999-1288?
CVE-1999-1288 specifically affects Samba version 1.9.18.
Can CVE-1999-1288 be exploited remotely?
No, CVE-1999-1288 can only be exploited by local users on systems where the vulnerable version of Samba is installed.
Which operating systems are impacted by CVE-1999-1288?
CVE-1999-1288 affects several versions of SCO OpenLinux, Red Hat Linux, and Turbolinux that include Samba 1.9.18.