CVE-1999-1501: Medium severity SGI IRIX vulnerability

Published Apr 8, 1998

Updated

(1) ipxchk and (2) ipxlink in SGI OS2 IRIX 6.3 does not properly clear the IFS environmental variable before executing system calls, which allows local users to execute arbitrary commands.

Affected Software

1 affected component

SGI IRIX=6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove SGI IRIX/ipxchk from your environment.
If ipxchk is not required, remove/uninstall the ipxchk binary from systems; otherwise restrict its availability to trusted administrators only.
Remove
Remove SGI IRIX/ipxlink from your environment.
If ipxlink is not required, remove/uninstall the ipxlink binary from systems; otherwise restrict its availability to trusted administrators only.
Configuration
Modify ipxchk and ipxlink so they explicitly clear or unset the IFS environment variable (or set it to a known-safe value) before invoking system(), exec*(), or other command-execution interfaces.
SGI IRIX: ipxchk and ipxlink IFS environment variable handling = clear/unset IFS before executing system calls
Compensating control
Until a code fix is applied, restrict local access to affected hosts and limit execution of ipxchk and ipxlink (for example, remove execute permission for non-administrative users or place the binaries in a directory accessible only to administrators); isolate vulnerable systems from untrusted local users.

Event History

Apr 8, 1998

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Sep 12, 2001

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-1501?

CVE-1999-1501 is classified as a local privilege escalation vulnerability that can allow arbitrary command execution.

How do I fix CVE-1999-1501?

To fix CVE-1999-1501, ensure the IFS environmental variable is properly cleared before executing any system calls in the affected applications.

Which software is affected by CVE-1999-1501?

CVE-1999-1501 affects the SGI IRIX operating system version 6.3.

Can remote users exploit CVE-1999-1501?

No, CVE-1999-1501 can only be exploited by local users with access to the affected system.

What are the potential impacts of exploiting CVE-1999-1501?

Exploiting CVE-1999-1501 can allow an attacker to execute arbitrary commands on the affected system, potentially leading to system compromise.