CVE-1999-1409: Low severity SGI IRIX vulnerability
The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
atfrom your environment.Uninstall the 'at' program if it is not required to prevent local users from submitting files with the -f argument and receiving file contents via e-mail.
- Configuration
Restrict execution of the at binary to trusted administrators by changing ownership, file mode, or applying filesystem ACLs so unprivileged local users cannot run at -f.
at executable permission = restricted to trusted users - Compensating control
Apply controls to prevent leakage of file contents via at job mail notifications (for example, filter or block delivery of system-generated mail from at jobs, or route such mail to quarantined/administrative mailboxes).
- Operational
Audit recent at jobs and mail logs to determine whether sensitive files were exposed via at -f; notify affected parties and rotate any credentials or secrets that may have been disclosed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1409?
The severity of CVE-1999-1409 is considered moderate, as it allows local users to read arbitrary file content.
How do I fix CVE-1999-1409?
To fix CVE-1999-1409, ensure you upgrade to a version of IRIX or NetBSD that is not vulnerable, or apply appropriate security patches.
Which versions are affected by CVE-1999-1409?
CVE-1999-1409 affects SGI IRIX versions 6.2 to 6.5.1 and NetBSD versions up to and including 1.3.2.
Can CVE-1999-1409 be exploited remotely?
CVE-1999-1409 cannot be exploited remotely as it requires local user access to the system.
What is the impact of CVE-1999-1409?
The impact of CVE-1999-1409 allows local users to access sensitive information from arbitrary files via error message e-mails.