CVE-1999-1407: Low severity redhat Linux vulnerability
ifdhcpc-done script for configuring DHCP on Red Hat Linux 5 allows local users to append text to arbitrary files via a symlink attack on the dhcplog file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ifdhcpc-done (Red Hat Linux)from your environment.If the ifdhcpc-done script is not required, uninstall or disable it to remove the vulnerable functionality (disable DHCP client hooks that invoke the script).
- Configuration
Ensure the dhcplog file is owned by root and is not writable by unprivileged users (for example, set ownership to root:root and restrict permissions so only root can write). This prevents local users from creating a symlink to cause the script to append to arbitrary files.
dhcplog (used by ifdhcpc-done) file permissions/ownership = owner: root; not writable by unprivileged users
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1407?
CVE-1999-1407 is considered a moderate severity vulnerability due to its potential for local users to manipulate files via a symlink attack.
How do I fix CVE-1999-1407?
To fix CVE-1999-1407, ensure that the permissions on the dhcplog file are set correctly to prevent unauthorized access by local users.
What systems are affected by CVE-1999-1407?
CVE-1999-1407 affects Red Hat Linux version 5.0.
What type of attack is involved in CVE-1999-1407?
CVE-1999-1407 involves a symlink attack that allows local users to append text to arbitrary files.
Can CVE-1999-1407 be exploited remotely?
CVE-1999-1407 cannot be exploited remotely, as it requires local user access to the affected system.