# CVE-1999-1161: HP HP-UX privilege escalation in ppl via core dump

Source: https://junglewise.ai/threats/cve-1999-1161-hp-hp-ux-privilege-escalation-in-ppl-via-core-dump  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1161 · Severity: high · CVSS 7.2 · Published 1996-11-03

A vulnerability in the 'ppl' utility on older HP-UX systems allows a local user to gain full administrative (root) control. By forcing the program to crash and create a memory dump file in a specific location, an attacker can overwrite system configuration files. This allows them to bypass security restrictions and take over the entire server.

Technologies: [Hp-Ux](https://junglewise.ai/threats/technologies/hp-ux). Vendors: [Hp](https://junglewise.ai/threats/vendors/hp).

## Quick answers

**Is CVE-1999-1161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1161 being exploited in the wild.

**How severe is CVE-1999-1161?** High severity, with a CVSS score of 7.2, published 3 November 1996.

**Which products and versions are affected?** Hp-Ux 10.x and earlier.

**Is there a fix for CVE-1999-1161?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1161 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1161?** Check whether you run Hp-Ux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'ppl' utility in HP-UX 10.x and earlier is vulnerable to a privilege escalation attack via insecure core dump handling. A local attacker can create a symbolic link from a core file in the current directory to a sensitive system file, such as ~root/.rhosts. By providing a specially crafted, overly long string to the '-o' flag, the attacker triggers a buffer overflow that causes the program to crash. Because the program may be running with elevated privileges or within a world-writable directory, the resulting core dump (containing attacker-controlled data) overwrites the linked file, allowing the attacker to gain root access via services like remsh.

## Affected products

- HP HP-UX 10.x and earlier

## Timeline

- 1996-11-03: disclosed: Initial public disclosure on Bugtraq
- 1996-11-03: advisory: NVD published date

## References

- [http://ciac.llnl.gov/ciac/bulletins/h-32.shtml](http://ciac.llnl.gov/ciac/bulletins/h-32.shtml)
- [http://marc.info/?l=bugtraq&m=87602167420102&w=2](http://marc.info/?l=bugtraq&m=87602167420102&w=2)
- [http://marc.info/?l=bugtraq&m=87602167420103&w=2](http://marc.info/?l=bugtraq&m=87602167420103&w=2)
- [http://www.codetalker.com/advisories/vendor/hp/hpsbux9704-057.html](http://www.codetalker.com/advisories/vendor/hp/hpsbux9704-057.html)
- [http://www.iss.net/security_center/static/7438.php](http://www.iss.net/security_center/static/7438.php)

## Related threats

- [IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands…](https://junglewise.ai/threats/cve-2026-13476-ibm-informix-dynamic-server-14-10-15-0-and-12-10-could-allow-an)
- [IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.](https://junglewise.ai/threats/cve-2026-13367-ibm-informix-dynamic-server-14-10-and-15-0-contain-a-local)
- [Multiple Vendors TCP/IP Land denial of service](https://junglewise.ai/threats/cve-1999-0016-multiple-vendors-tcp-ip-land-denial-of-service)
- [Sun Solaris automountd command injection via shell metacharacters](https://junglewise.ai/threats/cve-1999-0210-sun-solaris-automountd-command-injection-via-shell-metacharacters)
- [Linux inetd denial of service via SYN and RST packets](https://junglewise.ai/threats/cve-1999-0216-linux-inetd-denial-of-service-via-syn-and-rst-packets)