CVE-1999-1586: High severity Sun SunOS vulnerability
loadmodule in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, which allows local users to gain privileges, a different vulnerability than CVE-1999-1584.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SunOS/loadmodulefrom your environment.Disable or remove the loadmodule binary/feature on affected SunOS 4.1.x systems or otherwise prevent it from being executed.
- Remove
Remove
xnews (uses loadmodule)from your environment.Uninstall or stop using xnews on affected SunOS 4.1.x systems until a vendor-supplied fix is available.
- Compensating control
Restrict who can execute loadmodule/xnews on affected hosts (for example, remove execute permissions for untrusted accounts or enforce local access controls) to mitigate local privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1586?
CVE-1999-1586 is considered a high severity vulnerability due to its potential to allow local users to gain unauthorized privileges.
How do I fix CVE-1999-1586?
To fix CVE-1999-1586, users should apply the latest patches available for SunOS versions 4.1.1, 4.1.2, 4.1.3, and 4.1.3c.
Who is affected by CVE-1999-1586?
CVE-1999-1586 affects users of SunOS versions 4.1.1 through 4.1.3c that utilize the loadmodule function.
What causes CVE-1999-1586?
CVE-1999-1586 is caused by the loadmodule utility in SunOS 4.1.x not properly sanitizing its environment, allowing local privilege escalation.
What are the implications of CVE-1999-1586?
The implications of CVE-1999-1586 include the risk of local users gaining elevated privileges, which can compromise the system integrity and security.