# CVE-1999-0108: SGI IRIX buffer overflow in printers program

Source: https://junglewise.ai/threats/cve-1999-0108-sgi-irix-buffer-overflow-in-printers-program  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1998-05-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0108 · Severity: high · CVSS 7.2 · Published 1998-05-01

The printers utility in the SGI IRIX operating system contains a security flaw that allows a local user to gain full administrative (root) control over the system. This utility is responsible for managing printer configurations, and the vulnerability can be exploited by a standard user to bypass security restrictions and potentially access sensitive data or disrupt operations. This issue affects older versions of the IRIX platform commonly used in high-performance computing environments.

Technologies: [Sgi Irix](https://junglewise.ai/threats/technologies/irix). Vendors: [Sgi](https://junglewise.ai/threats/vendors/sgi).

## Quick answers

**Is CVE-1999-0108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0108 being exploited in the wild.

**How severe is CVE-1999-0108?** High severity, with a CVSS score of 7.2, published 1 May 1998.

**Which products and versions are affected?** SGI IRIX 5.3, 6.2, 6.3.

**Is there a fix for CVE-1999-0108?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0108 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0108?** Check whether you run Sgi Irix. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the /usr/sbin/printers executable in SGI IRIX. The flaw is triggered via the -xrm command-line argument, which fails to properly validate the length of input data before copying it into a fixed-size buffer. A local attacker can exploit this by passing a specially crafted, overly long string to the program, allowing them to overwrite the return address on the stack and redirect execution to an attacker-supplied shellcode. Successful exploitation results in arbitrary code execution with root privileges. The vulnerability has been confirmed on IRIX versions 5.3, 6.2, and 6.3.

## Affected products

- SGI IRIX 5.3, 6.2, 6.3

## Timeline

- 1997-05-27: disclosed: Exploit code posted to Bugtraq mailing list by David Hedley
- 1998-05-01: advisory: NVD publication date

## References

- [http://seclists.org/bugtraq/1997/May/191](http://seclists.org/bugtraq/1997/May/191)

## Related threats

- [Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned…](https://junglewise.ai/threats/cve-1999-1492-vulnerability-in-1-diskperf-and-2-diskalign-in-irix-6-4-allows)
- [Vulnerability in (1) diskalign and (2) diskperf in IRIX 6.4 patches 2291 and 2848 allow a local user to create…](https://junglewise.ai/threats/cve-1999-1039-vulnerability-in-1-diskalign-and-2-diskperf-in-irix-6-4-patches)
- [SGI IRIX buffer overflow in xterm and Xaw](https://junglewise.ai/threats/cve-1999-0126-sgi-irix-buffer-overflow-in-xterm-and-xaw)
- [SGI IRIX command injection in ipxchk and ipxlink](https://junglewise.ai/threats/cve-1999-1501-sgi-irix-command-injection-in-ipxchk-and-ipxlink)
- [SGI IRIX NetWare Client privilege escalation in ipxchk and ipxlink](https://junglewise.ai/threats/cve-1999-1040-sgi-irix-netware-client-privilege-escalation-in-ipxchk-and-ipxlink)