CVE-1999-1388: Medium severity Sun SunOS vulnerability
passwd in SunOS 4.1.x allows local users to overwrite arbitrary files via a symlink attack and the -F command line argument.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Prevent the passwd program from being invoked with the -F command-line argument. Disable or remove support for -F (for example, replace passwd with a wrapper that rejects -F) until a patched/fixed binary is available.
passwd (SunOS 4.1.x) -F command-line option = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1388?
CVE-1999-1388 is considered a high severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-1999-1388?
To fix CVE-1999-1388, users should avoid using the passwd command with the -F option and ensure proper permissions are set for sensitive files.
Who is affected by CVE-1999-1388?
CVE-1999-1388 affects local users of SunOS 4.1.x who can exploit symlink vulnerabilities.
What type of attack is associated with CVE-1999-1388?
CVE-1999-1388 is associated with a symlink attack that allows local users to overwrite arbitrary files.
Can CVE-1999-1388 be exploited remotely?
No, CVE-1999-1388 can only be exploited locally, requiring an authenticated local user.