CVE-1999-0046: Multiple Vendors rlogin buffer overflow via TERM environment variable

CVE-1999-0046 · Severity: critical · CVSS 10 · Published 1997-02-06

A vulnerability exists in the rlogin utility, a tool used for remote login and terminal access on various Unix-like operating systems. By providing a specially crafted terminal environment variable, an attacker can crash the system or potentially gain full control over the affected machine. This could lead to a complete compromise of the server, including unauthorized access to sensitive data and disruption of services.

Technologies: Bsdi Bsd Os, Debian Linux, Digital Ultrix, Hp-Ux, IBM Aix, Oracle Solaris. Vendors: Bsdi, Debian, Digital, Hp, IBM, Oracle.

Quick answers

Is CVE-1999-0046 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-1999-0046 being exploited in the wild.
How severe is CVE-1999-0046?
Critical severity, with a CVSS score of 10, published 6 February 1997.
Which products and versions are affected?
Bsdi Bsd Os 1.1, 2.0, 2.0.1, 2.1; Debian Linux 0.93; Digital Ultrix 2.2, 3.0, 4.0, 4.1, 4.2, 4.3, 4.3a, 4.4, 4.5; Hp-Ux 10.00, 10.01, 10.08, 10.09, 10.10, 10.16, 10.20, 10.24, 10.30, 10.34; and 2 more.
Is there a fix for CVE-1999-0046?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0046 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-1999-0046?
Check whether you run Bsdi Bsd Os, Debian Linux, Digital Ultrix or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The rlogin utility is vulnerable to a classic buffer overflow (CWE-120) when processing the TERM environment variable. The program fails to perform adequate bounds checking on the size of the input provided via this variable before copying it into a fixed-size buffer. An attacker can exploit this by passing an excessively long string in the TERM variable, allowing them to overwrite the stack and redirect execution flow. This vulnerability is typically exploitable over the network without authentication, potentially leading to remote code execution with the privileges of the rlogin process (often root). Numerous legacy Unix and Unix-like operating systems are affected, including versions of AIX, FreeBSD, HP-UX, and Solaris.

Affected products

  • BSDI BSD/OS 1.1, 2.0, 2.0.1, 2.1
  • Debian Debian Linux 0.93
  • Digital Ultrix 2.2, 3.0, 4.0, 4.1, 4.2, 4.3, 4.3a, 4.4, 4.5
  • FreeBSD Project FreeBSD 1.1.5.1, 2.0, 2.0.5, 2.1.0, 2.1.5
  • HP HP-UX 10.00, 10.01, 10.08, 10.09, 10.10, 10.16, 10.20, 10.24, 10.30, 10.34
  • IBM AIX 3.2, 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5
  • NetBSD Foundation NetBSD 1.0, 1.1
  • Oracle/Sun Solaris 2.4, 2.5.1, 2.6, 7.0, 8, 5.3, 5.4, 5.5, 5.5.1

Timeline

  • 1997-02-06: disclosed: Initial publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.