Is CVE-1999-0078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0078 being exploited in the wild.

How severe is CVE-1999-0078?

Low severity, with a CVSS score of 1.9, published 18 April 1996.

Which products and versions are affected?

Sun Microsystems Pcnfsd Solaris 2.4, 2.5; SunOS 5.4, 5.5.

Is there a fix for CVE-1999-0078?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0078 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-0078?

Check whether you run Sun Microsystems Pcnfsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0078: Sun Microsystems pcnfsd command injection and file permission manipulation

CVE-1999-0078 · Severity: low · CVSS 1.9 · Published 1996-04-18

A vulnerability in the pcnfsd service, which handles authentication and printing for PC clients on Unix networks, allows local users to gain unauthorized control over files. An attacker with access to the system could change file permissions or run their own commands, potentially leading to the theft of sensitive data or a full system takeover. This affects older Unix-based systems like Solaris and SunOS.

Vendors: Sun Microsystems.

Quick answers

Is CVE-1999-0078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0078 being exploited in the wild.
How severe is CVE-1999-0078?: Low severity, with a CVSS score of 1.9, published 18 April 1996.
Which products and versions are affected?: Sun Microsystems Pcnfsd Solaris 2.4, 2.5; SunOS 5.4, 5.5.
Is there a fix for CVE-1999-0078?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0078 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-0078?: Check whether you run Sun Microsystems Pcnfsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The pcnfsd (rpc.pcnfsd) daemon contains a vulnerability where it fails to properly sanitize or validate arguments passed during Remote Procedure Calls (RPC). A local attacker can exploit this by crafting specific RPC requests that include malicious arguments, leading to unauthorized file permission changes (chmod) or arbitrary command execution. The vulnerability is primarily reachable by local users on the system. While the CVSS 2.0 score is low (1.9), the impact includes potential privilege escalation if the daemon runs with elevated privileges. This issue was historically identified in SunOS and Solaris environments.

Affected products

Sun Microsystems pcnfsd (rpc.pcnfsd) Solaris 2.4, 2.5; SunOS 5.4, 5.5

Timeline

1996-04-18: disclosed: Initial publication date in NVD

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0078

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.