Quick answers
- Is CVE-1999-1106 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-1106 being exploited in the wild.
- How severe is CVE-1999-1106?
- High severity, with a CVSS score of 7.2, published 29 April 1998.
- Which products and versions are affected?
- KDE KDE kppp.
- Is there a fix for CVE-1999-1106?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-1106 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-1106?
- Check whether you run Kde or Kde Kppp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow exists in the kppp utility within the KDE desktop environment. The vulnerability is triggered when the application processes an excessively long string passed via the '-c' (account_name) command-line argument. Because kppp was often installed with setuid root permissions to manage network interfaces, a local attacker can exploit this overflow to overwrite the instruction pointer and execute arbitrary code with elevated privileges. This results in a complete compromise of the local system. The issue was originally identified in 1998 and affects early versions of the KDE suite.
Affected products
- KDE KDE kppp
Timeline
- 1998-04-29: disclosed: Initial public disclosure and NVD publication