# CVE-1999-1123: Sun Microsystems Sun Source privilege escalation in makeinstall and winstall

Source: https://junglewise.ai/threats/cve-1999-1123-sun-microsystems-sun-source-privilege-escalation-in-makeinstall  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1991-05-20. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1123 · Severity: high · CVSS 7.2 · Published 1991-05-20

A vulnerability in the installation scripts for Sun Source (sunsrc) software allows local users to gain full administrative control over the system. By exploiting specific installation programs, a standard user can elevate their privileges to root, potentially leading to complete system compromise and unauthorized access to all data.

Vendors: [Sun Microsystems](https://junglewise.ai/threats/vendors/sun-microsystems).

## Quick answers

**Is CVE-1999-1123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1123 being exploited in the wild.

**How severe is CVE-1999-1123?** High severity, with a CVSS score of 7.2, published 20 May 1991.

**Which products and versions are affected?** Sun Microsystems Sun Source (sunsrc) Tapes.

**Is there a fix for CVE-1999-1123?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1123 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1123?** Check whether you run Sun Microsystems Sun Source Tapes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the Sun Source (sunsrc) tape installation process. The issue stems from the 'makeinstall' and 'winstall' programs being installed with setuid root permissions. A local, unprivileged attacker can execute these programs to bypass security controls and gain root-level access. This vulnerability is reachable only by users with local access to the system where the sunsrc tapes are being installed or have been installed. Patches were historically provided by Sun Microsystems via security bulletin 107.

## Affected products

- Sun Microsystems Sun Source (sunsrc) Tapes

## Timeline

- 1991-05-20: advisory: Initial NVD publication date
- 1991-05-20: disclosed: Date of CERT advisory CA-1991-07 and Sun security bulletin 107

## References

- [http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/107&type=0&nav=sec.sba](http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/107&type=0&nav=sec.sba)
- [http://www.cert.org/advisories/CA-1991-07.html](http://www.cert.org/advisories/CA-1991-07.html)
- [http://www.securityfocus.com/bid/21](http://www.securityfocus.com/bid/21)
- [http://www.securityfocus.com/bid/22](http://www.securityfocus.com/bid/22)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/582](https://exchange.xforce.ibmcloud.com/vulnerabilities/582)