Quick answers
- Is CVE-1999-0334 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0334 being exploited in the wild.
- How severe is CVE-1999-0334?
- High severity, with a CVSS score of 7.2, published 16 December 1993.
- Which products and versions are affected?
- Sun Microsystems Solaris 2.2, 2.3.
- Is there a fix for CVE-1999-0334?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0334 attacked?
- It is attacked with physical access, in an operating system.
- Am I affected by CVE-1999-0334?
- Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a local privilege escalation occurring during the boot process of Solaris 2.2 and 2.3. When the 'fsck' (file system consistency check) utility encounters an unrecoverable error or failure during startup, the system initialization scripts fail to properly secure the environment and instead drop the console into a single-user mode root shell. An attacker with physical access to the machine can trigger or wait for this state to bypass authentication and obtain full root privileges. This is a classic boot-time configuration flaw where the failure state of a system maintenance tool results in an insecure fallback.
Affected products
- Sun Microsystems Solaris 2.2, 2.3
Timeline
- 1993-12-16: disclosed