# CVE-1999-0966: Sun Solaris buffer overflow in libc getopt function

Source: https://junglewise.ai/threats/cve-1999-0966-sun-solaris-buffer-overflow-in-libc-getopt-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-01-27. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0966 · Severity: high · CVSS 7.2 · Published 1997-01-27

A vulnerability in a core system library of the Solaris operating system could allow a local user to take full control of the machine. By providing an unexpectedly long program name when running a command, an attacker can trigger a memory error that grants them administrative (root) privileges. This poses a significant risk to the integrity and confidentiality of data on affected systems.

Technologies: [Sunos](https://junglewise.ai/threats/technologies/sunos). Vendors: [Sun](https://junglewise.ai/threats/vendors/sun).

## Quick answers

**Is CVE-1999-0966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0966 being exploited in the wild.

**How severe is CVE-1999-0966?** High severity, with a CVSS score of 7.2, published 27 January 1997.

**Which products and versions are affected?** Sun Microsystems Solaris 2.5, 5.5.

**Is there a fix for CVE-1999-0966?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0966 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0966?** Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow exists in the 'getopt' function within the Solaris standard C library (libc). The vulnerability is triggered when a program using getopt is executed with an excessively long string in the first argument of the argument vector (argv[0]). Because many system utilities run with elevated privileges (setuid root), a local attacker can exploit this memory corruption to overwrite the execution stack and redirect process flow to arbitrary code. This results in a full privilege escalation from a standard user to root. The issue affects Solaris 2.5 and SunOS 5.5.

## Affected products

- Sun Microsystems Solaris 2.5, 5.5

## Timeline

- 1997-01-27: disclosed

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0966](https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0966)

## Related threats

- [Sun NIS+ authentication bypass in rpc.nisd](https://junglewise.ai/threats/cve-1999-0795-sun-nis-authentication-bypass-in-rpc-nisd)
- [Sun Solaris arbitrary file read in volrmmount](https://junglewise.ai/threats/cve-1999-0296-sun-solaris-arbitrary-file-read-in-volrmmount)
- [Sun Solaris Telnet denial of service via control characters](https://junglewise.ai/threats/cve-1999-0273-sun-solaris-telnet-denial-of-service-via-control-characters)
- [Sun Microsystems SunOS kernel panic via /dev/tcx0 read](https://junglewise.ai/threats/cve-1999-1449-sun-microsystems-sunos-kernel-panic-via-dev-tcx0-read)
- [Sun WorkMan arbitrary file overwrite and privilege escalation](https://junglewise.ai/threats/cve-1999-0277-sun-workman-arbitrary-file-overwrite-and-privilege-escalation)