CVE-1999-1507: High severity Sun SunOS vulnerability
Sun SunOS 4.1 through 4.1.3 allows local attackers to gain root access via insecure permissions on files and directories such as crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure files and directories such as 'crash' are owned by root and are not writable by group or others. Remove unnecessary SUID/SGID bits on programs that do not require them. Use appropriate chown/chmod to set ownership to root and tighten permissions (for example, remove group/other write and remove SUID/SGID where not required).
SunOS file/directory permissions (e.g., 'crash') permissions/ownership = owned by root; remove write permissions for group/others; remove unnecessary SUID/SGID bits - Operational
Perform a system-wide audit for insecure permissions and setuid/setgid files, correct any findings, and inspect for signs of compromise. Examples of checks include searching for world-writable files and files with SUID/SGID bits and then correcting ownership/permissions; after remediation, review logs and running processes and restart affected services as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1507?
CVE-1999-1507 is rated as high severity due to the potential for local attackers to gain root access.
How do I fix CVE-1999-1507?
To fix CVE-1999-1507, ensure proper file and directory permissions are set on sensitive system files such as crash.
Which versions of SunOS are affected by CVE-1999-1507?
CVE-1999-1507 affects SunOS versions 4.1 through 4.1.3 inclusive.
Can CVE-1999-1507 be exploited remotely?
No, CVE-1999-1507 requires local access to the system to exploit the vulnerability.
What type of vulnerability is CVE-1999-1507?
CVE-1999-1507 is a local privilege escalation vulnerability that arises from insecure permissions.