# CVE-1999-0025: SGI IRIX buffer overflow in df command

Source: https://junglewise.ai/threats/cve-1999-0025-sgi-irix-buffer-overflow-in-df-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-07-16. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0025 · Severity: high · CVSS 7.2 · Published 1997-07-16

A vulnerability in the 'df' command on SGI IRIX systems could allow a local user to take full control of the computer. The 'df' tool is a standard utility used to check disk space; because it runs with elevated system privileges, a flaw in how it handles input allows an attacker to bypass security restrictions. This could result in an unauthorized user gaining 'root' or administrative access, leading to a total compromise of the system's data and operations.

Technologies: [Sgi Irix](https://junglewise.ai/threats/technologies/irix). Vendors: [Sgi](https://junglewise.ai/threats/vendors/sgi).

## Quick answers

**Is CVE-1999-0025 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0025 being exploited in the wild.

**How severe is CVE-1999-0025?** High severity, with a CVSS score of 7.2, published 16 July 1997.

**Which products and versions are affected?** SGI IRIX All versions prior to November 1997 patches.

**Is there a fix for CVE-1999-0025?** A patch was published on 1997-11-18: SGI released security advisory and patches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-1999-0025 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0025?** Check whether you run Sgi Irix. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'df' utility on SGI IRIX due to insufficient bounds checking on directory or block device arguments. Because the 'df' executable is setuid root, a local attacker can provide a specially crafted, overly long argument to overwrite the stack and execute arbitrary code with administrative privileges. The vulnerability can be mitigated by removing the setuid bit from the 'df' binary, using a wrapper to truncate arguments, or applying the official patches released by SGI in 1997.

## Affected products

- SGI IRIX All versions prior to November 1997 patches

## Timeline

- 1997-05-24: disclosed: Initial public disclosure
- 1997-07-16: advisory: NVD publication date
- 1997-11-18: patched: SGI released security advisory and patches

## References

- [http://www.cert.org/advisories/CA-1997-21.html](http://www.cert.org/advisories/CA-1997-21.html)
- [http://www.kb.cert.org/vuls/id/20851](http://www.kb.cert.org/vuls/id/20851)
- [http://www.securityfocus.com/bid/346](http://www.securityfocus.com/bid/346)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/440](https://exchange.xforce.ibmcloud.com/vulnerabilities/440)

## Related threats

- [Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned…](https://junglewise.ai/threats/cve-1999-1492-vulnerability-in-1-diskperf-and-2-diskalign-in-irix-6-4-allows)
- [Vulnerability in (1) diskalign and (2) diskperf in IRIX 6.4 patches 2291 and 2848 allow a local user to create…](https://junglewise.ai/threats/cve-1999-1039-vulnerability-in-1-diskalign-and-2-diskperf-in-irix-6-4-patches)
- [SGI IRIX buffer overflow in xterm and Xaw](https://junglewise.ai/threats/cve-1999-0126-sgi-irix-buffer-overflow-in-xterm-and-xaw)
- [SGI IRIX buffer overflow in printers program](https://junglewise.ai/threats/cve-1999-0108-sgi-irix-buffer-overflow-in-printers-program)
- [SGI IRIX command injection in ipxchk and ipxlink](https://junglewise.ai/threats/cve-1999-1501-sgi-irix-command-injection-in-ipxchk-and-ipxlink)