CVE-1999-1299: Critical severity Slackware Slackware Linux vulnerability
rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rcpfrom your environment.Uninstall or remove the rcp program/binaries from affected systems (e.g., Red Hat Linux and Slackware Linux) or otherwise prevent its use.
- Configuration
Disable rcp (and associated rsh) services on affected systems to prevent use until a fix is available.
rcp/rsh enabled = false - Compensating control
If removal or disabling is not immediately possible, block or restrict rcp/rsh traffic and access (e.g., via firewall, host-based ACLs, or network segmentation) to trusted hosts only until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1299?
CVE-1999-1299 has a moderate severity rating due to the potential for arbitrary file overwriting by unauthorized users.
How do I fix CVE-1999-1299?
To fix CVE-1999-1299, update the affected systems to the latest version of your Linux distribution that addresses this vulnerability.
Which Linux systems are affected by CVE-1999-1299?
CVE-1999-1299 affects various Linux systems, specifically Red Hat 4.0 and Slackware 3.1.
Who can exploit CVE-1999-1299?
The CVE-1999-1299 vulnerability can be exploited by users with a UID of 65535, often the 'nobody' user.
What are the impacts of CVE-1999-1299?
The impact of CVE-1999-1299 allows attackers to overwrite arbitrary files, potentially leading to system compromise.