CVE-1999-1413: Medium severity Sun Solaris vulnerability

Published Aug 3, 1996

Updated

Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.

Affected Software

2 affected components

Sun Solaris=2.4

Sun SunOS=5.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Solaris 2.4 to a version that resolves this vulnerability.
Patch kernel jumbo patch -35

Event History

Aug 3, 1996

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Sep 12, 2001

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-1413?

CVE-1999-1413 is considered a high-severity vulnerability due to its potential to allow local users to gain elevated privileges.

How do I fix CVE-1999-1413?

To fix CVE-1999-1413, apply the kernel jumbo patch -35 or later for Solaris 2.4.

What systems are affected by CVE-1999-1413?

CVE-1999-1413 affects Solaris 2.4 and SunOS 5.4 systems that do not have the appropriate patches installed.

What does CVE-1999-1413 allow attackers to do?

CVE-1999-1413 allows local users to overwrite or create files with higher privileges by inducing a core dump.

Is CVE-1999-1413 a remote or local vulnerability?

CVE-1999-1413 is a local vulnerability, meaning it can only be exploited by users with local access to the affected system.