# CVE-1999-1139: HP HP-UX arbitrary file overwrite in CUE via symlink attack

Source: https://junglewise.ai/threats/cve-1999-1139-hp-hp-ux-arbitrary-file-overwrite-in-cue-via-symlink-attack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-09-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1139 · Severity: high · CVSS 7.2 · Published 1997-09-01

A vulnerability in the Character-Terminal User Environment (CUE) on older HP-UX systems allows local users to gain full administrative control. By exploiting how the system handles temporary error files, a standard user can overwrite critical system files like the password database. This can lead to a complete system takeover, data loss, or permanent disruption of operations.

Technologies: [Hp-Ux](https://junglewise.ai/threats/technologies/hp-ux). Vendors: [Hp](https://junglewise.ai/threats/vendors/hp).

## Quick answers

**Is CVE-1999-1139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1139 being exploited in the wild.

**How severe is CVE-1999-1139?** High severity, with a CVSS score of 7.2, published 1 September 1997.

**Which products and versions are affected?** HP HP-UX 11.0 and earlier.

**Is there a fix for CVE-1999-1139?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1139 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1139?** Check whether you run Hp-Ux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Character-Terminal User Environment (CUE) utility in HP-UX (specifically version 11.0 and earlier, including 10.20) contains a symlink vulnerability. The application, which runs with setuid root privileges, fails to properly validate the 'IOERROR.mytty' file before writing to it. A local attacker can manipulate the environment by setting a specific LOGNAME and umask, then creating a symbolic link from 'IOERROR.mytty' to a sensitive system file (such as /etc/passwd). When CUE is executed, it follows the symlink and overwrites the target file with root permissions, allowing the attacker to escalate privileges to root. HP released patches (e.g., HPSBUX9801-074) to address this issue.

## Affected products

- HP HP-UX 11.0 and earlier

## Timeline

- 1997-09-01: disclosed: Initial discovery and Bugtraq post by Leonid S. Knyshov
- 1997-09-01: advisory: NVD publication date

## References

- [http://marc.info/?l=bugtraq&m=87602880019745&w=2](http://marc.info/?l=bugtraq&m=87602880019745&w=2)
- [http://security-archive.merton.ox.ac.uk/bugtraq-199801/0122.html](http://security-archive.merton.ox.ac.uk/bugtraq-199801/0122.html)
- [http://www.ciac.org/ciac/bulletins/i-027b.shtml](http://www.ciac.org/ciac/bulletins/i-027b.shtml)
- [http://www.codetalker.com/advisories/vendor/hp/hpsbux9801-074.html](http://www.codetalker.com/advisories/vendor/hp/hpsbux9801-074.html)
- [http://www.iss.net/security_center/static/2007.php](http://www.iss.net/security_center/static/2007.php)

## Related threats

- [IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands…](https://junglewise.ai/threats/cve-2026-13476-ibm-informix-dynamic-server-14-10-15-0-and-12-10-could-allow-an)
- [IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.](https://junglewise.ai/threats/cve-2026-13367-ibm-informix-dynamic-server-14-10-and-15-0-contain-a-local)
- [Multiple Vendors TCP/IP Land denial of service](https://junglewise.ai/threats/cve-1999-0016-multiple-vendors-tcp-ip-land-denial-of-service)
- [Sun Solaris automountd command injection via shell metacharacters](https://junglewise.ai/threats/cve-1999-0210-sun-solaris-automountd-command-injection-via-shell-metacharacters)
- [Linux inetd denial of service via SYN and RST packets](https://junglewise.ai/threats/cve-1999-0216-linux-inetd-denial-of-service-via-syn-and-rst-packets)