# CVE-1999-0323: FreeBSD and NetBSD file integrity bypass in mmap function

Source: https://junglewise.ai/threats/cve-1999-0323-freebsd-and-netbsd-file-integrity-bypass-in-mmap-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1998-02-20. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0323 · Severity: critical · CVSS 10 · Published 1998-02-20

A vulnerability in the FreeBSD and NetBSD operating systems allows users to bypass file protections. Specifically, it enables the modification of files that were intended to be permanent or append-only, such as system logs or security configurations. This could allow an attacker to hide their tracks or compromise the integrity of the entire system.

Technologies: [Bsdi Bsd Os](https://junglewise.ai/threats/technologies/bsd-os), [Freebsd](https://junglewise.ai/threats/technologies/freebsd), [Netbsd](https://junglewise.ai/threats/technologies/netbsd), [Openbsd](https://junglewise.ai/threats/technologies/openbsd). Vendors: [Bsdi](https://junglewise.ai/threats/vendors/bsdi), [Freebsd](https://junglewise.ai/threats/vendors/freebsd), [Netbsd](https://junglewise.ai/threats/vendors/netbsd), [OpenBSD](https://junglewise.ai/threats/vendors/openbsd).

## Quick answers

**Is CVE-1999-0323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0323 being exploited in the wild.

**How severe is CVE-1999-0323?** Critical severity, with a CVSS score of 10, published 20 February 1998.

**Which products and versions are affected?** FreeBSD FreeBSD; NetBSD NetBSD.

**Is there a fix for CVE-1999-0323?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0323 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0323?** Check whether you run Bsdi Bsd Os, Freebsd, Netbsd or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the mmap system call implementation within FreeBSD and NetBSD. The flaw allows a local user to map a file into memory with write permissions even if the file is marked with the 'append-only' or 'immutable' system flags. By modifying the memory-mapped region, the attacker can bypass filesystem-level protections intended to preserve the integrity of critical system files and logs. This is a local privilege escalation or integrity bypass vulnerability. Patches were historically addressed in NetBSD-SA1998-003 and corresponding FreeBSD security updates.

## Affected products

- FreeBSD FreeBSD
- NetBSD NetBSD

## Timeline

- 1998-02-20: disclosed
- 1998-02-20: advisory

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD RACK stack buffer overflow in tcp_rack](https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a)