Is CVE-1999-1095 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1095 being exploited in the wild.

How severe is CVE-1999-1095?

High severity, with a CVSS score of 7.2, published 6 October 1997.

Which products and versions are affected?

Red Hat Linux 4.1, 4.2; SuSE Linux 5.0, 4.4.1; Slackware Linux 3.3; FreeBSD Project FreeBSD 2.2.2.

Is there a fix for CVE-1999-1095?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1095 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1095?

Check whether you run Redhat Linux or Slackware Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1095: Multiple Linux Distributions sort utility symlink vulnerability in /tmp

CVE-1999-1095 · Severity: high · CVSS 7.2 · Published 1997-10-06

A vulnerability in the 'sort' utility, commonly used by system maintenance tasks like 'updatedb', allows local users to corrupt or overwrite sensitive system files. By predicting the names of temporary files created during sorting processes, an attacker can redirect data into critical files such as password databases or system configurations. This can lead to a complete system compromise or a denial of service by destroying essential operating system data.

Technologies: Redhat Linux, Slackware Linux. Vendors: Redhat, Slackware.

Quick answers

Is CVE-1999-1095 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1095 being exploited in the wild.
How severe is CVE-1999-1095?: High severity, with a CVSS score of 7.2, published 6 October 1997.
Which products and versions are affected?: Red Hat Linux 4.1, 4.2; SuSE Linux 5.0, 4.4.1; Slackware Linux 3.3; FreeBSD Project FreeBSD 2.2.2.
Is there a fix for CVE-1999-1095?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1095 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1095?: Check whether you run Redhat Linux or Slackware Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'sort' utility (often GNU sort) creates temporary files in /tmp using predictable naming conventions (e.g., sortPID0001). Because the utility follows symbolic links when opening these temporary files, a local attacker can perform a symlink race attack. By creating a symbolic link at the predicted temporary file path pointing to a sensitive target (like /etc/shadow), the attacker can force the 'sort' process to overwrite that target with sorted data. This is particularly critical when 'sort' is invoked by root-privileged cron jobs such as 'updatedb'. The vulnerability was addressed in later versions of Red Hat and SuSE by modifying how temporary files are handled or how the calling scripts are executed.

Affected products

Red Hat Linux 4.1, 4.2
SuSE Linux 5.0, 4.4.1
Slackware Linux 3.3
FreeBSD Project FreeBSD 2.2.2

Timeline

1997-08-05: advisory: KSR[T] Advisory #003 released
1997-10-06: disclosed: Initial disclosure date listed in NVD
1998-03-02: other: Additional exploitation details shared on Bugtraq regarding updatedb symlinks

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.