CVE-1999-1394: Low severity BSD BSD vulnerability
BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for files by unmounting the file system and using a file system editor such as fsdb to directly modify the file through a device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
fsdbfrom your environment.Remove or restrict access to the fsdb file system editor (and similar raw-device editing utilities) so that even if a filesystem is unmounted, it cannot be directly modified through the device by an attacker or an over-privileged account.
- Configuration
Do not run BSD 4.4-based systems at security level 1. Set the system security level to a value other than 1 to prevent the root user from clearing immutable and append-only file flags by unmounting and editing the device.
BSD system security level security level = not 1 - Compensating control
Restrict administrative and physical access that would allow unmounting filesystems or direct raw-device access. Enforce least-privilege for accounts that can unmount filesystems or access device nodes, and limit who can perform maintenance requiring raw device editors.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1394?
The severity of CVE-1999-1394 is considered medium due to the potential for unauthorized modification of file attributes.
How do I fix CVE-1999-1394?
To fix CVE-1999-1394, ensure that the system is running at a security level higher than 1 to prevent unauthorized access by the root user.
What operating systems are affected by CVE-1999-1394?
CVE-1999-1394 affects BSD 4.4 based operating systems that are configured to run at security level 1.
What are the implications of CVE-1999-1394?
CVE-1999-1394 allows the root user to circumvent file integrity protections, potentially leading to data loss or system compromise.
Who is impacted by CVE-1999-1394?
System administrators and users of BSD 4.4 based operating systems are primarily impacted by CVE-1999-1394 due to its security implications.