CVE-1999-1584: Critical severity Sun Openwindows vulnerability
Unknown vulnerability in (1) loadmodule, and (2) modload if modload is installed with setuid/setgid privileges, in SunOS 4.1.1 through 4.1.3c, and Open Windows 3.0, allows local users to gain root privileges via environment variables, a different vulnerability than CVE-1999-1586.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
loadmodulefrom your environment.Uninstall or remove the loadmodule component if it is not required to eliminate the unknown privilege-escalation vulnerability.
- Remove
Remove
modloadfrom your environment.Uninstall or remove the modload component if it is not required (or remove setuid/setgid as above) to eliminate the privilege-escalation risk.
- Configuration
Remove the setuid/setgid permissions from the modload binary (disable setuid/setgid) so it cannot be used to gain root via environment variables.
modload setuid/setgid = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1584?
CVE-1999-1584 is considered a high severity vulnerability as it allows local users to gain root privileges.
How do I fix CVE-1999-1584?
To mitigate CVE-1999-1584, ensure that the loadmodule and modload programs do not have setuid/setgid privileges.
Which operating systems are affected by CVE-1999-1584?
CVE-1999-1584 affects SunOS versions 4.1.1 through 4.1.3c and Sun OpenWindows 3.0.
What can attackers do with CVE-1999-1584?
Attackers can exploit CVE-1999-1584 to execute arbitrary commands with root privileges due to improper handling of environment variables.
Is there a way to detect CVE-1999-1584 on my system?
You can detect CVE-1999-1584 by checking the permissions of the loadmodule and modload binaries on your affected SunOS system.