Is CVE-1999-1133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1133 being exploited in the wild.

How severe is CVE-1999-1133?

Medium severity, with a CVSS score of 4.6, published 1 September 1997.

Is there a fix for CVE-1999-1133?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1133 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1133?

Check whether you run Hp-Ux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1133: HP HP-UX privilege escalation in X Windows utilities

CVE-1999-1133 · Severity: medium · CVSS 4.6 · Published 1997-09-01

A vulnerability in HP-UX operating systems running X Windows allows local users to gain unauthorized elevated privileges. By exploiting specific system utilities like file managers and text editors, a user who already has basic access to the system can bypass authentication and perform actions with higher-level permissions. This could lead to unauthorized data access or full control over the affected workstation or server.

Technologies: Hp-Ux. Vendors: Hp.

Quick answers

Is CVE-1999-1133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1133 being exploited in the wild.
How severe is CVE-1999-1133?: Medium severity, with a CVSS score of 4.6, published 1 September 1997.
Which products and versions are affected?: Hp-Ux 9.x, 10.x.
Is there a fix for CVE-1999-1133?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1133 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1133?: Check whether you run Hp-Ux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in HP-UX 9.x and 10.x within the X Windows environment. The issue stems from several SetUID/SetGID utilities, specifically vuefile, vuepad, dtfile, and dtpad, which fail to properly authenticate users or validate environment variables, allowing a local attacker to execute commands with the privileges of the application owner (often root). This is closely related to underlying buffer overflows in the libXt and Motif libraries (X11R5/X11R6). Attackers with local shell access can exploit these binaries to gain administrative control. HP released several patches (e.g., PHSS_11626, PHSS_11043) to address the library vulnerabilities and updated the affected VUE/CDE components.

Affected products

HP HP-UX 9.x, 10.x

Timeline

1997-09-01: advisory: Initial NVD publication date
1997-09-09: disclosed: HP Security Bulletin HPSBUX9709-069 released via Bugtraq

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.