Is CVE-1999-0129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0129 being exploited in the wild.

How severe is CVE-1999-0129?

Medium severity, with a CVSS score of 4.6, published 3 December 1996.

Which products and versions are affected?

Sendmail Sendmail 8.8.3 and earlier; Sun Microsystems Solaris 2.3, 2.4, 2.5, 2.5.1.

Is there a fix for CVE-1999-0129?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0129 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-0129?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0129: Sendmail local privilege escalation via .forward or :include: files

CVE-1999-0129 · Severity: medium · CVSS 4.6 · Published 1996-12-03

A vulnerability in the Sendmail email routing software allows local users to gain unauthorized file access. By manipulating specific mail forwarding and inclusion files, a user can write to files they should not have access to and gain elevated group permissions. This could lead to the compromise of sensitive data or system configuration files on the affected server.

Quick answers

Is CVE-1999-0129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0129 being exploited in the wild.
How severe is CVE-1999-0129?: Medium severity, with a CVSS score of 4.6, published 3 December 1996.
Which products and versions are affected?: Sendmail Sendmail 8.8.3 and earlier; Sun Microsystems Solaris 2.3, 2.4, 2.5, 2.5.1.
Is there a fix for CVE-1999-0129?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0129 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-0129?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Sendmail (specifically versions prior to 8.8.4) where the handling of .forward and :include: files does not properly restrict file system operations. A local attacker with a system account can exploit this by creating or modifying these files to point to arbitrary locations, allowing them to write to files with the permissions of the group Sendmail is running under. This is a local privilege escalation and file integrity issue. The vulnerability was addressed in Sendmail 8.8.4 and via vendor-specific patches for operating systems like Solaris.

Affected products

Sendmail Sendmail 8.8.3 and earlier
Sun Microsystems Solaris 2.3, 2.4, 2.5, 2.5.1

Timeline

1996-12-03: disclosed
1996-12-03: advisory: CERT Advisory CA-1996-25 released

References

http://www.cert.org/advisories/CA-1996-25.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.