# CVE-1999-1197: Sun Microsystems SunOS privilege escalation in TIOCCONS

Source: https://junglewise.ai/threats/cve-1999-1197-sun-microsystems-sunos-privilege-escalation-in-tioccons  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1990-12-20. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1197 · Severity: high · CVSS 7.2 · Published 1990-12-20

A vulnerability in the SunOS operating system allows a local user to improperly redirect console input and output. This flaw could be exploited by an authorized user on the system to gain elevated administrative privileges, potentially leading to full control over the machine and its data.

Technologies: [Sunos](https://junglewise.ai/threats/technologies/sunos). Vendors: [Sun](https://junglewise.ai/threats/vendors/sun).

## Quick answers

**Is CVE-1999-1197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1197 being exploited in the wild.

**How severe is CVE-1999-1197?** High severity, with a CVSS score of 7.2, published 20 December 1990.

**Which products and versions are affected?** Sun Microsystems SunOS 4.1.1.

**Is there a fix for CVE-1999-1197?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1197 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1197?** Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists within the TIOCCONS ioctl function in SunOS 4.1.1. The system fails to perform adequate permission checks when a user requests to redirect console I/O to a different terminal. A local attacker with standard user access can exploit this lack of validation to intercept sensitive console traffic or manipulate system inputs, ultimately facilitating a privilege escalation to root. This is a local attack requiring no special preconditions other than system access. Patch information was historically provided in CERT advisory CA-1990-12.

## Affected products

- Sun Microsystems SunOS 4.1.1

## Timeline

- 1990-12-20: advisory: Initial NVD publication and CERT advisory release

## References

- [http://www.cert.org/advisories/CA-1990-12.html](http://www.cert.org/advisories/CA-1990-12.html)
- [http://www.iss.net/security_center/static/7140.php](http://www.iss.net/security_center/static/7140.php)
- [http://www.securityfocus.com/bid/14](http://www.securityfocus.com/bid/14)

## Related threats

- [Sun NIS+ authentication bypass in rpc.nisd](https://junglewise.ai/threats/cve-1999-0795-sun-nis-authentication-bypass-in-rpc-nisd)
- [Sun Solaris arbitrary file read in volrmmount](https://junglewise.ai/threats/cve-1999-0296-sun-solaris-arbitrary-file-read-in-volrmmount)
- [Sun Solaris Telnet denial of service via control characters](https://junglewise.ai/threats/cve-1999-0273-sun-solaris-telnet-denial-of-service-via-control-characters)
- [Sun Microsystems SunOS kernel panic via /dev/tcx0 read](https://junglewise.ai/threats/cve-1999-1449-sun-microsystems-sunos-kernel-panic-via-dev-tcx0-read)
- [Sun Solaris buffer overflow in libc getopt function](https://junglewise.ai/threats/cve-1999-0966-sun-solaris-buffer-overflow-in-libc-getopt-function)