CVE-1999-1468: Medium severity SGI IRIX vulnerability
rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
rdistfrom your environment.If rdist is not required, uninstall or disable it to eliminate this privilege-escalation vector until a secure fix is applied.
- Configuration
Within rdist, clear or explicitly set the IFS environment variable to a known safe value before invoking external programs (such as sendmail) so local user-modified IFS cannot affect shell parsing.
rdist IFS (Internal Field Separator) = sanitized/cleared before invoking external commands - Configuration
Modify rdist to stop using popen (which invokes a shell) to execute sendmail; instead invoke sendmail directly without a shell or use a safe library/API call to prevent shell interpretation influenced by the environment.
rdist method of invoking sendmail = avoid using popen/shell invocation; invoke sendmail directly or via safe API - Compensating control
Restrict access to the rdist binary (file permissions/ACLs) to trusted administrative users only until the code is fixed, to reduce the risk from local users modifying the environment.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1468?
CVE-1999-1468 is considered a high severity vulnerability due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-1468?
To fix CVE-1999-1468, users should upgrade to a patched version of the affected software that removes the vulnerability in the rdist application.
Which systems are affected by CVE-1999-1468?
CVE-1999-1468 affects various UNIX systems, including certain versions of SGI IRIX, SunOS, and NeXT.
Is CVE-1999-1468 exploitable remotely?
CVE-1999-1468 is not typically exploitable remotely as it requires local user access to the affected systems.
What vulnerability does CVE-1999-1468 present?
CVE-1999-1468 presents a privilege escalation vulnerability by allowing local users to manipulate the IFS variable and execute arbitrary commands.