CVE-1999-1493: Critical severity hp apollo domain os vulnerability
Vulnerability in crp in Hewlett Packard Apollo Domain OS SR10 through SR10.3 allows remote attackers to gain root privileges via insecure system calls, (1) pad$dmcmd and (2) pad$defpfk().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Isolate systems running Hewlett Packard Apollo Domain OS SR10 through SR10.3 (affected crp component) from untrusted networks. Restrict or block remote access to management ports and services using firewall rules or ACLs (allow only trusted IPs) until a vendor patch or remediation is available.
- Operational
Assume possible compromise for exposed systems: collect and preserve forensic logs, review for unauthorized root activity or changes related to crp, rotate all credentials and SSH keys used on affected systems, and rebuild or restore systems from known-good backups if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1493?
CVE-1999-1493 has a high severity rating due to the potential for remote attackers to gain root privileges.
How do I fix CVE-1999-1493?
To mitigate CVE-1999-1493, you should upgrade your Hewlett Packard Apollo Domain OS to a version beyond SR10.3 that addresses this vulnerability.
What systems are affected by CVE-1999-1493?
CVE-1999-1493 affects Hewlett Packard Apollo Domain OS versions SR10 through SR10.3.
What are the attack vectors for CVE-1999-1493?
CVE-1999-1493 can be exploited by remote attackers through insecure system calls such as pad_$dm_cmd and pad_$def_pfk().
Is CVE-1999-1493 still a relevant threat?
While CVE-1999-1493 is an older vulnerability, it may still pose risks for systems that have not been updated or patched.