CVE-1999-1461: High severity SGI IRIX vulnerability
inpview in InPerson on IRIX 5.3 through IRIX 6.5.10 trusts the PATH environmental variable to find and execute the ttsession program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse ttsession program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX/InPerson inpviewfrom your environment.Uninstall or disable inpview (InPerson) if the component is not required.
- Configuration
Modify inpview so it invokes the ttsession program by an absolute pathname (or otherwise does not consult the PATH environment variable) to avoid executing a Trojan ttsession found via PATH.
InPerson inpview ttsession invocation = absolute path (do not rely on PATH) - Configuration
Ensure the PATH used when running privileged or setuid programs (such as inpview) does not include directories writable by unprivileged users; set or sanitize PATH to a safe value before executing inpview.
Environment for privileged/setuid programs PATH = exclude user-writable directories - Compensating control
Ensure the directory containing the legitimate ttsession binary is owned by root and not writable by unprivileged users; restrict filesystem permissions to prevent replacement of the ttsession executable by a Trojan.
- Operational
Audit PATH entries and filesystem locations for unauthorized or Trojan ttsession binaries, remove any found, and investigate systems for signs of root compromise; remediate any compromise before returning systems to production.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1461?
CVE-1999-1461 is considered a critical vulnerability due to its potential to allow local users to gain root access.
How do I fix CVE-1999-1461?
To fix CVE-1999-1461, ensure that the PATH variable does not point to untrusted locations and consider updating to a patched version of IRIX.
Which versions of IRIX are affected by CVE-1999-1461?
CVE-1999-1461 affects IRIX versions 5.3 through 6.5.10 including 6.1, 6.2, 6.3, 6.4, and 6.5.10.
Who can exploit CVE-1999-1461?
CVE-1999-1461 can be exploited by local users who have access to modify the PATH environment variable.
What specific program is involved in CVE-1999-1461?
The vulnerability in CVE-1999-1461 revolves around the inpview utility's reliance on the PATH variable to execute the ttsession program.