CVE-1999-1402: Low severity FreeBSD FreeBSD vulnerability
The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On affected systems (Solaris 2.x, SunOS 4.x, and BSD-based OS before 4.4) mitigate risk by restricting local user access: remove or disable unneeded local accounts, restrict logins to trusted administrators, and run services that create UNIX domain sockets on isolated hosts/containers or under strong access controls so untrusted local users cannot reach them.
- Operational
Enable auditing and monitoring for creation and connections to UNIX domain sockets on the affected systems; alert on unexpected local socket connections and review logs for potential misuse. Apply service restarts or service isolation after account changes as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1402?
CVE-1999-1402 is considered a local privilege escalation vulnerability that could potentially disrupt operations.
How do I fix CVE-1999-1402?
To fix CVE-1999-1402, adjust the access permissions for the UNIX domain sockets or upgrade to a patched version of the affected software.
Which operating systems are affected by CVE-1999-1402?
CVE-1999-1402 affects Solaris 2.x, SunOS 4.x, and various BSD-based operating systems before 4.4.
What is the impact of CVE-1999-1402?
The impact of CVE-1999-1402 is that local users can connect to unsecured UNIX domain sockets and potentially control or disrupt the application using them.
Can CVE-1999-1402 be exploited remotely?
No, CVE-1999-1402 requires local access to the system for exploitation.