# CVE-1999-1142: Sun Microsystems SunOS privilege escalation via LD_* environment variables

Source: https://junglewise.ai/threats/cve-1999-1142-sun-microsystems-sunos-privilege-escalation-via-ld-environment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1992-05-27. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1142 · Severity: high · CVSS 7.2 · Published 1992-05-27

A vulnerability in older versions of the SunOS operating system allows local users to gain administrative control of the system. By manipulating specific system settings used by common programs like login and mail services, an attacker can bypass security restrictions to execute commands with elevated privileges. This could lead to a complete compromise of the affected machine and unauthorized access to all stored data.

Technologies: [Sunos](https://junglewise.ai/threats/technologies/sunos). Vendors: [Sun](https://junglewise.ai/threats/vendors/sun).

## Quick answers

**Is CVE-1999-1142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1142 being exploited in the wild.

**How severe is CVE-1999-1142?** High severity, with a CVSS score of 7.2, published 27 May 1992.

**Which products and versions are affected?** Sun Microsystems SunOS 4.1.2 and earlier.

**Is there a fix for CVE-1999-1142?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1142 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1142?** Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a privilege escalation flaw involving the dynamic linker and environment variable handling in SunOS 4.1.2 and earlier. Local attackers can exploit this by setting 'LD_*' environment variables (such as LD_LIBRARY_PATH or LD_PRELOAD) when executing certain dynamically linked setuid or setgid binaries, including 'login', 'su', and 'sendmail'. The issue occurs specifically in programs that change their real and effective user IDs to the same user, failing to properly sanitize the environment before execution. Successful exploitation allows a non-privileged local user to execute arbitrary code with the privileges of the setuid/setgid program, typically resulting in root access. Patch information was originally released in Sun Security Bulletin #116 and CERT Advisory CA-1992-11.

## Affected products

- Sun Microsystems SunOS 4.1.2 and earlier

## Timeline

- 1992-05-27: advisory: NVD published date
- 1992-12-31: advisory: CERT advisory CA-1992-11 published

## References

- [http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/116](http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/116)
- [http://www.cert.org/advisories/CA-1992-11.html](http://www.cert.org/advisories/CA-1992-11.html)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/3152](https://exchange.xforce.ibmcloud.com/vulnerabilities/3152)

## Related threats

- [Sun NIS+ authentication bypass in rpc.nisd](https://junglewise.ai/threats/cve-1999-0795-sun-nis-authentication-bypass-in-rpc-nisd)
- [Sun Solaris arbitrary file read in volrmmount](https://junglewise.ai/threats/cve-1999-0296-sun-solaris-arbitrary-file-read-in-volrmmount)
- [Sun Solaris Telnet denial of service via control characters](https://junglewise.ai/threats/cve-1999-0273-sun-solaris-telnet-denial-of-service-via-control-characters)
- [Sun Microsystems SunOS kernel panic via /dev/tcx0 read](https://junglewise.ai/threats/cve-1999-1449-sun-microsystems-sunos-kernel-panic-via-dev-tcx0-read)
- [Sun Solaris buffer overflow in libc getopt function](https://junglewise.ai/threats/cve-1999-0966-sun-solaris-buffer-overflow-in-libc-getopt-function)