# CVE-1999-1057: DEC VMS privilege escalation in ANALYZE/PROCESS_DUMP command

Source: https://junglewise.ai/threats/cve-1999-1057-dec-vms-privilege-escalation-in-analyze-process-dump-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1990-10-25. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1057 · Severity: medium · CVSS 4.6 · Published 1990-10-25

A vulnerability in the VMS operating system allows local users to gain unauthorized administrative privileges. By using a specific system command designed for analyzing process memory dumps, a user can bypass security controls. This could lead to a complete takeover of the system and unauthorized access to sensitive data.

Vendors: [Digital](https://junglewise.ai/threats/vendors/digital), [Digital Equipment Corporation](https://junglewise.ai/threats/vendors/digital-equipment-corporation).

## Quick answers

**Is CVE-1999-1057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1057 being exploited in the wild.

**How severe is CVE-1999-1057?** Medium severity, with a CVSS score of 4.6, published 25 October 1990.

**Which products and versions are affected?** Digital Equipment Corporation (DEC) VMS 4.0 through 5.3.

**Is there a fix for CVE-1999-1057?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1057 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1057?** Check whether you run Digital Vms or Digital Equipment Corporation OpenVMS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in VMS versions 4.0 through 5.3 within the ANALYZE/PROCESS_DUMP Digital Command Language (DCL) command. The flaw allows a local, authenticated user to execute the command in a manner that elevates their process privileges. This is a classic local privilege escalation (LPE) where an attacker with low-level access can gain system-level control. The vulnerability was originally identified in 1990 and addressed in subsequent VMS updates. Exploitation requires local access to the DCL interface.

## Affected products

- Digital Equipment Corporation (DEC) VMS 4.0 through 5.3

## Timeline

- 1990-10-25: advisory: Initial NVD publication and CERT advisory release

## References

- [http://ciac.llnl.gov/ciac/bulletins/b-04.shtml](http://ciac.llnl.gov/ciac/bulletins/b-04.shtml)
- [http://www.cert.org/advisories/CA-1990-07.html](http://www.cert.org/advisories/CA-1990-07.html)
- [http://www.iss.net/security_center/static/7137.php](http://www.iss.net/security_center/static/7137.php)
- [http://www.securityfocus.com/bid/12](http://www.securityfocus.com/bid/12)