CVE-1999-1338: Medium severity Delegate DeleGate vulnerability
Delegate proxy 5.9.3 and earlier creates files and directories in the DGROOT with world-writable permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the DGROOT with filesystem ACLs or host-level access controls so only trusted service accounts and administrators can read or write. If possible, isolate hosts running the Delegate proxy from untrusted networks and restrict management access to trusted IPs.
- Operational
Recursively remove world-writable permissions from files and directories in the DGROOT used by the Delegate proxy (for example: chmod -R o-w /path/to/DGROOT). Verify and correct ownership and file modes so that only the required service account and administrators have write access. Scan the DGROOT to ensure no remaining world-writable items exist.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1338?
CVE-1999-1338 is considered a moderate severity vulnerability due to its potential for unauthorized access via world-writable permissions.
How do I fix CVE-1999-1338?
To fix CVE-1999-1338, update Delegate to version 5.9.4 or later, where the issue of world-writable permissions has been addressed.
What are the consequences of CVE-1999-1338?
The consequences of CVE-1999-1338 include the risk of unauthorized users being able to modify or create files in the DGROOT directory.
Which versions of Delegate are affected by CVE-1999-1338?
Versions of Delegate up to and including 5.9.3 are affected by CVE-1999-1338.
Is CVE-1999-1338 a common vulnerability?
CVE-1999-1338 is not commonly encountered today, but it remains a significant example of misconfigured file permissions in software.