# CVE-1999-1080: Sun SunOS rmmount privilege escalation via removable media

Source: https://junglewise.ai/threats/cve-1999-1080-sun-sunos-rmmount-privilege-escalation-via-removable-media  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1995-05-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1080 · Severity: high · CVSS 7.2 · Published 1995-05-10

A vulnerability in the removable media mounting service of SunOS 5.7 allows users with physical access to a machine to gain full administrative (root) control. By inserting a floppy disk or CD-ROM containing a specially crafted program and triggering the mount process, a standard user can bypass security restrictions that should prevent unauthorized privilege elevation. This poses a significant risk to workstations or servers where unauthorized individuals have physical access to disk drives.

Technologies: [Sunos](https://junglewise.ai/threats/technologies/sunos). Vendors: [Sun](https://junglewise.ai/threats/vendors/sun).

## Quick answers

**Is CVE-1999-1080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1080 being exploited in the wild.

**How severe is CVE-1999-1080?** High severity, with a CVSS score of 7.2, published 10 May 1995.

**Which products and versions are affected?** Sun Microsystems SunOS 5.7.

**Is there a fix for CVE-1999-1080?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1080 attacked?** It is attacked with physical access or with local access, in an operating system.

**Am I affected by CVE-1999-1080?** Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rmmount utility in SunOS 5.7 contains a logic error where it fails to enforce the 'nosuid' mount option for removable media (floppies and CD-ROMs), despite documentation stating otherwise. An attacker with local account access and physical access to the hardware can insert media containing a setuid-root binary and execute 'volcheck' to mount the filesystem. Because the 'nosuid' flag is missing, the setuid bit is honored, allowing the attacker to execute the binary and escalate privileges to root. This behavior differs from previous SunOS versions. A workaround involves manually adding 'mount' entries with the '-o nosuid' flag to /etc/rmmount.conf.

## Affected products

- Sun Microsystems SunOS 5.7

## Timeline

- 1995-05-10: disclosed: Initial public disclosure via Bugtraq (Note: NVD date 1995 may be an outlier vs 1999 CVE ID)
- 1999-05-10: other: Detailed Bugtraq report by Jonas Stahre regarding Solaris 7/SunOS 5.7 behavior

## References

- [http://marc.info/?l=bugtraq&m=92633694100270&w=2](http://marc.info/?l=bugtraq&m=92633694100270&w=2)
- [http://marc.info/?l=bugtraq&m=93971288323395&w=2](http://marc.info/?l=bugtraq&m=93971288323395&w=2)
- [http://www.securityfocus.com/bid/250](http://www.securityfocus.com/bid/250)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/8350](https://exchange.xforce.ibmcloud.com/vulnerabilities/8350)

## Related threats

- [Sun NIS+ authentication bypass in rpc.nisd](https://junglewise.ai/threats/cve-1999-0795-sun-nis-authentication-bypass-in-rpc-nisd)
- [Sun Solaris arbitrary file read in volrmmount](https://junglewise.ai/threats/cve-1999-0296-sun-solaris-arbitrary-file-read-in-volrmmount)
- [Sun Solaris Telnet denial of service via control characters](https://junglewise.ai/threats/cve-1999-0273-sun-solaris-telnet-denial-of-service-via-control-characters)
- [Sun Microsystems SunOS kernel panic via /dev/tcx0 read](https://junglewise.ai/threats/cve-1999-1449-sun-microsystems-sunos-kernel-panic-via-dev-tcx0-read)
- [Sun Solaris buffer overflow in libc getopt function](https://junglewise.ai/threats/cve-1999-0966-sun-solaris-buffer-overflow-in-libc-getopt-function)