Quick answers
- Is CVE-1999-0050 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0050 being exploited in the wild.
- How severe is CVE-1999-0050?
- High severity, with a CVSS score of 7.2, published 1 December 1996.
- Which products and versions are affected?
- HP HP-UX.
- Is there a fix for CVE-1999-0050?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0050 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-0050?
- Check whether you run Hp-Ux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A buffer overflow vulnerability exists within the 'newgrp' executable in HP-UX. The 'newgrp' utility is typically a setuid-root program used to change a user's current group ID during a login session. By providing specially crafted, overly long input to the program, a local attacker can trigger a memory corruption event. Because the utility runs with elevated privileges, successful exploitation allows the attacker to execute arbitrary code with root-level permissions.
Affected products
- HP HP-UX
Timeline
- 1996-12-01: disclosed