Is CVE-1999-1103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1103 being exploited in the wild.

How severe is CVE-1999-1103?

Medium severity, with a CVSS score of 4.6, published 3 April 1996.

Is there a fix for CVE-1999-1103?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1103 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1103?

Check whether you run Digital Osf 1. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1103: DEC OSF/1 arbitrary file read in dxconsole

CVE-1999-1103 · Severity: medium · CVSS 4.6 · Published 1996-04-03

A vulnerability in the dxconsole utility of the DEC OSF/1 operating system allows local users to read sensitive files they should not have access to. By exploiting this flaw, an attacker with a standard user account could view system configuration files or private data, potentially leading to further unauthorized access or data theft. This affects older versions of the DEC OSF/1 operating system.

Vendors: Digital.

Quick answers

Is CVE-1999-1103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1103 being exploited in the wild.
How severe is CVE-1999-1103?: Medium severity, with a CVSS score of 4.6, published 3 April 1996.
Which products and versions are affected?: DEC OSF/1 3.2C and earlier.
Is there a fix for CVE-1999-1103?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1103 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1103?: Check whether you run Digital Osf 1. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The dxconsole utility in DEC OSF/1 version 3.2C and earlier contains an arbitrary file read vulnerability. A local attacker can exploit this by using the '-file' command-line parameter to specify a file that the user would normally not have permissions to view. Because the utility does not properly restrict file access based on the user's privileges, it can be used to disclose sensitive system or user information. This is a local vulnerability requiring shell access to the affected system. Patch information is referenced in historical vendor bulletins from DEC and CERT.

Affected products

DEC OSF/1 3.2C and earlier

Timeline

1996-04-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.