CVE-1999-1491: High severity redhat Linux vulnerability
abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via a path that points to a Trojan horse program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
abuse.console (Red Hat 2.1)from your environment.Uninstall or remove abuse.console from systems where it is not required.
- Configuration
Modify abuse.console so it invokes the undrv program using an absolute pathname (do not rely on relative pathnames) or otherwise verify the targeted executable before execution.
abuse.console undrv path resolution = absolute path - Compensating control
Ensure the PATH used when abuse.console runs does not include directories writable by unprivileged users; restrict filesystem permissions for directories in PATH and place undrv in a trusted, non-writable location.
- Operational
Search the filesystem and all directories in PATH for unauthorized or Trojan horse copies of undrv; remove or replace any untrusted binaries and verify the integrity of the legitimate undrv executable.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1491?
The severity of CVE-1999-1491 is considered high due to its potential to allow local users to execute arbitrary commands.
How do I fix CVE-1999-1491?
To fix CVE-1999-1491, update to a version of Red Hat Linux that does not use relative pathnames in the abuse.console program.
Who is affected by CVE-1999-1491?
Local users of Red Hat Linux version 2.1 are affected by CVE-1999-1491.
What is the exploit method for CVE-1999-1491?
The exploit method for CVE-1999-1491 involves manipulating the path to execute the undrv program via a Trojan horse program.
What type of vulnerability is CVE-1999-1491 classified as?
CVE-1999-1491 is classified as a local privilege escalation vulnerability.