Quick answers
- Is CVE-1999-1123 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-1123 being exploited in the wild.
- How severe is CVE-1999-1123?
- High severity, with a CVSS score of 7.2, published 20 May 1991.
- Which products and versions are affected?
- Sun Microsystems Sun Source (sunsrc) Tapes.
- Is there a fix for CVE-1999-1123?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-1123 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-1123?
- Check whether you run Sun Microsystems Sun Source Tapes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A privilege escalation vulnerability exists in the Sun Source (sunsrc) tape installation process. The issue stems from the 'makeinstall' and 'winstall' programs being installed with setuid root permissions. A local, unprivileged attacker can execute these programs to bypass security controls and gain root-level access. This vulnerability is reachable only by users with local access to the system where the sunsrc tapes are being installed or have been installed. Patches were historically provided by Sun Microsystems via security bulletin 107.
Affected products
- Sun Microsystems Sun Source (sunsrc) Tapes
Timeline
- 1991-05-20: advisory: Initial NVD publication date
- 1991-05-20: disclosed: Date of CERT advisory CA-1991-07 and Sun security bulletin 107