CVE-1999-0125: SGI IRIX buffer overflow in mailx

CVE-1999-0125 · Severity: medium · CVSS 4.6 · Published 1998-01-25

A security vulnerability exists in the mailx utility on SGI IRIX systems, which is a standard command-line tool for managing electronic mail. An attacker with local access to the system could exploit this flaw to potentially gain unauthorized privileges or disrupt system operations. This could lead to a compromise of data integrity and confidentiality on the affected workstation or server.

Technologies: Sgi Irix. Vendors: Sgi.

Quick answers

Is CVE-1999-0125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-1999-0125 being exploited in the wild.
How severe is CVE-1999-0125?
Medium severity, with a CVSS score of 4.6, published 25 January 1998.
Which products and versions are affected?
Sgi Irix Not specified.
Is there a fix for CVE-1999-0125?
A patch was published on 1998-06-05: SGI security advisory date referenced in patches link Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-1999-0125 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-1999-0125?
Check whether you run Sgi Irix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overflow vulnerability exists within the mailx utility on SGI IRIX. The flaw is triggered when the application fails to properly validate the length of input data before copying it into a fixed-size buffer. A local attacker can exploit this by providing specially crafted input to the mailx program, leading to memory corruption. Successful exploitation can allow the attacker to execute arbitrary code with the privileges of the mailx process, which often runs with elevated permissions, or cause the application to crash. SGI released security advisories and patches (e.g., 19980605-01-PX) to address this issue.

Affected products

  • SGI IRIX Not specified

Timeline

  • 1998-01-25: disclosed
  • 1998-01-25: advisory: NVD Published Date
  • 1998-06-05: patched: SGI security advisory date referenced in patches link

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.