Is CVE-1999-1040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1040 being exploited in the wild.

How severe is CVE-1999-1040?

High severity, with a CVSS score of 7.2, published 8 April 1998.

Which products and versions are affected?

Novell NetWare Client 1.0; Sgi Irix 6.3, 6.4.

Is there a fix for CVE-1999-1040?

A patch was published on 1998-05-01: SGI released patch SG0002869 addressing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-1999-1040 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1040?

Check whether you run Novell NetWare Client or Sgi Irix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1040: SGI IRIX NetWare Client privilege escalation in ipxchk and ipxlink

CVE-1999-1040 · Severity: high · CVSS 7.2 · Published 1998-04-08

A vulnerability in the NetWare Client for SGI IRIX systems allows local users to gain full administrative (root) control of the machine. The issue exists in two utility programs that are installed with administrative privileges by default. An attacker with basic access to the system can exploit these utilities to bypass security restrictions and take over the entire operating system.

Technologies: Sgi Irix. Vendors: Novell, Sgi.

Quick answers

Is CVE-1999-1040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1040 being exploited in the wild.
How severe is CVE-1999-1040?: High severity, with a CVSS score of 7.2, published 8 April 1998.
Which products and versions are affected?: Novell NetWare Client 1.0; Sgi Irix 6.3, 6.4.
Is there a fix for CVE-1999-1040?: A patch was published on 1998-05-01: SGI released patch SG0002869 addressing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-1999-1040 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1040?: Check whether you run Novell NetWare Client or Sgi Irix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ipxchk and ipxlink binaries in NetWare Client 1.0 on IRIX 6.3 and 6.4 are installed setuid root but fail to properly sanitize the execution environment. Specifically, they are vulnerable to an Internal Field Separator (IFS) environmental variable attack. Because these binaries call other system programs using the system() function or similar methods without resetting the environment or hardcoding paths, a local attacker can modify the IFS variable to redirect execution to a malicious program. This results in arbitrary code execution with root privileges. The vulnerability was addressed in later patches by removing the setuid bit from the affected binaries.

Affected products

Novell NetWare Client 1.0
SGI IRIX 6.3, 6.4

Timeline

1997-06: disclosed: Initial report to SGI by researcher
1998-04-08: advisory: Public disclosure via Bugtraq and NVD publication
1998-05-01: patched: SGI released patch SG0002869 addressing the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.