CVE-1999-1534: Buffer Overflow
Buffer overflow in (1) nlservd and (2) rnavc in Knox Software Arkeia backup product allows local users to obtain root access via a long HOME environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Arkeia Network Backupfrom your environment.If Arkeia Network Backup is not required, uninstall the product from affected systems to eliminate the vulnerability until an official vendor fix is available.
- Configuration
Start nlservd and rnavc with a cleaned/sanitized environment that does not include user-controlled HOME, or ensure the service truncates/ignores HOME before processing to prevent a long HOME value from being used to exploit a buffer overflow.
Arkeia Network Backup (nlservd, rnavc) HOME environment handling = sanitize/ignore user-controlled HOME; do not allow excessively long HOME values - Compensating control
Prevent untrusted local users from running or interacting with Arkeia binaries: restrict local login and execution privileges, enforce host-level access controls/ACLs, and isolate backup hosts so only trusted administrators can access them.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1534?
The severity of CVE-1999-1534 is considered critical due to its potential to allow local users to gain root access.
How do I fix CVE-1999-1534?
To fix CVE-1999-1534, update to the latest version of the Arkeia backup software that addresses this vulnerability.
Who is affected by CVE-1999-1534?
CVE-1999-1534 affects users of Knox Software Arkeia version 4.0 running on systems with insecure HOME environment variables.
What are the consequences of exploiting CVE-1999-1534?
Exploiting CVE-1999-1534 can lead to unauthorized root access on the affected system, posing a significant security risk.
Is there a workaround for CVE-1999-1534?
A potential workaround for CVE-1999-1534 is to limit the length of the HOME environment variable to prevent buffer overflow.