# CVE-1999-0960: SGI IRIX arbitrary directory creation in cdplayer

Source: https://junglewise.ai/threats/cve-1999-0960-sgi-irix-arbitrary-directory-creation-in-cdplayer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1998-03-20. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0960 · Severity: high · CVSS 7.2 · Published 1998-03-20

The cdplayer utility in the SGI IRIX operating system contains a flaw that allows local users to create directories in restricted areas of the file system. This could allow an unauthorized user to disrupt system operations or potentially gain elevated privileges by placing directories in sensitive locations. This issue affects the integrity and availability of the host system.

Vendors: [Sgi](https://junglewise.ai/threats/vendors/sgi).

## Quick answers

**Is CVE-1999-0960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0960 being exploited in the wild.

**How severe is CVE-1999-0960?** High severity, with a CVSS score of 7.2, published 20 March 1998.

**Which products and versions are affected?** SGI IRIX cdplayer.

**Is there a fix for CVE-1999-0960?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0960 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0960?** Check whether you run Sgi Cdplayer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the SGI IRIX cdplayer utility allows local attackers to create directories in arbitrary locations on the file system. The issue stems from insufficient validation of command-line arguments, which can be manipulated to specify paths outside of the intended directory structure. Because the utility may run with elevated privileges (such as setuid), a local user can exploit this to bypass standard file system permissions. This can lead to a denial of service or be leveraged as a primitive for further privilege escalation. SGI released security advisory 19980301-01-PX to address this issue.

## Affected products

- SGI IRIX cdplayer

## Timeline

- 1998-03-20: advisory: Initial NVD publication date