CVE-1999-1498: Low severity Slackware Slackware Linux vulnerability
Slackware Linux 3.4 pkgtool allows local attacker to read and write to arbitrary files via a symlink attack on the reply file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
slackware/pkgtoolfrom your environment.If pkgtool is not required on affected systems, uninstall or remove the pkgtool package to eliminate the vulnerable component.
- Compensating control
Restrict local access: prevent untrusted or non-administrative local users from executing pkgtool or creating files/symlinks in locations used by pkgtool. Limit who can log in or gain shell access on affected systems.
- Operational
Do not run pkgtool with elevated privileges when untrusted users have access. Run package operations only from trusted administrative accounts and avoid running pkgtool in environments where local attackers can create symlinks to reply files.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1498?
CVE-1999-1498 has a medium severity rating due to the potential for local attackers to exploit the vulnerability.
How do I fix CVE-1999-1498?
To fix CVE-1999-1498, users should upgrade to a later version of Slackware Linux that does not contain this vulnerability.
What type of attack does CVE-1999-1498 involve?
CVE-1999-1498 involves a symlink attack that allows unauthorized reading and writing of files.
Who is affected by CVE-1999-1498?
CVE-1999-1498 affects local users of Slackware Linux version 3.4.
Can CVE-1999-1498 lead to privilege escalation?
Yes, CVE-1999-1498 can potentially allow local attackers to escalate privileges by manipulating files.