CVE-1999-1308: Medium severity HPE HP-UX vulnerability
Certain programs in HP-UX 10.20 do not properly handle large user IDs (UID) or group IDs (GID) over 60000, which could allow local users to gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change account provisioning and user/group creation policies so that new user IDs and group IDs are not assigned values greater than 60000 on HP-UX 10.20 systems.
HP-UX account management UID/GID allocation range = <=60000 - Compensating control
Until a vendor patch/fix is available, restrict local access and reduce privileges for untrusted local accounts on HP-UX 10.20 (for example, prevent direct interactive login where possible and tighten sudo/shell access) to limit the ability of local users to exploit the issue.
- Operational
Audit all user and group accounts on HP-UX 10.20 for UIDs or GIDs greater than 60000. Remediate any findings by reassigning those accounts to IDs <=60000 or disabling/removing the accounts as appropriate, and verify system functionality after changes.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1308?
CVE-1999-1308 is considered a local privilege escalation vulnerability.
How do I fix CVE-1999-1308?
To fix CVE-1999-1308, update to a patched version of HP-UX that properly handles user IDs and group IDs.
What programs are affected by CVE-1999-1308?
Programs in HP-UX 10.20 are affected if they do not handle large user IDs or group IDs correctly.
Who can exploit CVE-1999-1308?
CVE-1999-1308 can be exploited by local users who have access to the system.
What are the potential impacts of CVE-1999-1308?
The potential impacts of CVE-1999-1308 include unauthorized privilege escalation and access to restricted resources.