CVE-1999-1398: Medium severity SGI IRIX vulnerability
Vulnerability in xfsdump in SGI IRIX may allow local users to obtain root privileges via the bck.log log file, possibly via a symlink attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX xfsdumpfrom your environment.Uninstall or disable xfsdump until a vendor-supplied fix is available to eliminate the vulnerable component.
- Configuration
Ensure the bck.log file is owned by root, has restrictive permissions that prevent unprivileged users from writing to it, and is not a symbolic link. Remove any existing symlinks that point to bck.log.
SGI IRIX (bck.log) permissions / symlink status = owned by root; not writable by unprivileged users; not a symlink - Compensating control
Restrict which local accounts can execute xfsdump and restrict filesystem permissions/ACLs so untrusted local users cannot create or modify bck.log or related files. Apply these access controls until an official vendor patch is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1398?
CVE-1999-1398 is considered a high-severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-1398?
To fix CVE-1999-1398, you should ensure that no unauthorized users can access the bck.log log file and regularly apply patches provided by SGI for the IRIX versions affected.
Which versions of SGI IRIX are affected by CVE-1999-1398?
CVE-1999-1398 affects SGI IRIX versions 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3, 6.0, 6.0.1, 6.1, 6.2, 6.3, and 6.4.
What type of attack does CVE-1999-1398 allow?
CVE-1999-1398 potentially allows a local user to exploit a symlink attack to obtain root privileges.
Who is impacted by CVE-1999-1398?
Local users of SGI IRIX systems are impacted by CVE-1999-1398 due to the vulnerability in the xfsdump utility.