# CVE-1999-1032: DEC Ultrix privilege escalation in LAT/Telnet Gateway

Source: https://junglewise.ai/threats/cve-1999-1032-dec-ultrix-privilege-escalation-in-lat-telnet-gateway  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1991-12-31. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1032 · Severity: critical · CVSS 10 · Published 1991-12-31

A critical vulnerability exists in the LAT/Telnet Gateway component of the Ultrix operating system. This component is responsible for managing network connections between different terminal protocols. An attacker can exploit this flaw to gain full administrative (root) control over the system, potentially leading to complete data theft, system destruction, or unauthorized access to the corporate network.

## Quick answers

**Is CVE-1999-1032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1032 being exploited in the wild.

**How severe is CVE-1999-1032?** Critical severity, with a CVSS score of 10, published 31 December 1991.

**Which products and versions are affected?** Digital Equipment Corporation (DEC) Ultrix 4.1, 4.2.

**Is there a fix for CVE-1999-1032?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1032 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-1032?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the lattelnet (LAT/Telnet Gateway) utility on DEC Ultrix versions 4.1 and 4.2. The flaw allows an attacker to bypass security controls and escalate privileges to the root level. The attack vector is network-based and does not require prior authentication, as indicated by the CVSS vector AV:N/AC:L/Au:N. Successful exploitation results in a complete compromise of system confidentiality, integrity, and availability. While specific technical details of the memory corruption or logic error are not detailed in the legacy advisory, the impact is a full system takeover. Patches were historically provided by the vendor (Digital Equipment Corporation).

## Affected products

- Digital Equipment Corporation (DEC) Ultrix 4.1, 4.2

## Timeline

- 1991-12-31: disclosed: Initial disclosure via CERT and CIAC bulletins
- 1991-12-31: advisory: NVD published date

## References

- [http://ciac.llnl.gov/ciac/bulletins/b-36.shtml](http://ciac.llnl.gov/ciac/bulletins/b-36.shtml)
- [http://www.cert.org/advisories/CA-1991-11.html](http://www.cert.org/advisories/CA-1991-11.html)
- [http://www.securityfocus.com/bid/26](http://www.securityfocus.com/bid/26)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/584](https://exchange.xforce.ibmcloud.com/vulnerabilities/584)