CVE-1999-1471: Buffer Overflow
Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure or harden the passwd/account management process so that shell and GECOS fields are validated and limited to a reasonable maximum length; where built-in configuration is not available, restrict who may set or change these fields to administrators only.
BSD passwd shell/GECOS field length validation = enforce maximum length / disallow overly long values - Compensating control
Restrict account creation and modification and limit local login access to trusted administrators and accounts only (host-based access controls, local account policy, or similar) until an upstream fix is available to prevent unprivileged local users from exploiting the passwd vulnerability to gain root.
- Operational
Monitor BSD vendor/security advisories for a patch or fixed release for the passwd vulnerability; when a vendor-supplied fix is published, test and apply it promptly. In the meantime, audit passwd usage and account changes for suspicious activity and investigate any potential compromises.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1471?
CVE-1999-1471 has a high severity due to its potential to allow local users to gain root privileges.
How do I fix CVE-1999-1471?
To fix CVE-1999-1471, it is recommended to upgrade to a newer version of the BSD operating system that does not have this vulnerability.
What types of systems are affected by CVE-1999-1471?
CVE-1999-1471 affects BSD based operating systems, specifically versions 4.2 and 4.3.
Can CVE-1999-1471 be exploited remotely?
CVE-1999-1471 cannot be exploited remotely as it requires local user access to the system.
What is the impact of CVE-1999-1471 on my system?
The impact of CVE-1999-1471 can result in unauthorized root access, compromising system integrity and security.