Is CVE-1999-1225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1225 being exploited in the wild.

How severe is CVE-1999-1225?

Medium severity, with a CVSS score of 5, published 24 August 1997.

Which products and versions are affected?

Linux Foundation Linux; Digital Equipment Corporation (DEC) Ultrix.

Is there a fix for CVE-1999-1225?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1225 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-1999-1225?

Check whether you run Digital Ultrix, Linux Kernel, Netbsd or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1225: Linux and Ultrix Information Disclosure in rpc.mountd

CVE-1999-1225 · Severity: medium · CVSS 5 · Published 1997-08-24

A vulnerability in the rpc.mountd service, which manages network file sharing, allows remote individuals to probe a server for specific files. By attempting to mount a file, an attacker can determine if it exists based on the error messages returned by the system. This information disclosure can be used to map out sensitive file locations or verify the presence of specific software and configurations on the target system.

Technologies: Digital Ultrix, Linux Kernel, Netbsd, Openbsd. Vendors: Digital, Linux, Netbsd, OpenBSD.

Quick answers

Is CVE-1999-1225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1225 being exploited in the wild.
How severe is CVE-1999-1225?: Medium severity, with a CVSS score of 5, published 24 August 1997.
Which products and versions are affected?: Linux Foundation Linux; Digital Equipment Corporation (DEC) Ultrix.
Is there a fix for CVE-1999-1225?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1225 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-1999-1225?: Check whether you run Digital Ultrix, Linux Kernel, Netbsd or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The rpc.mountd daemon in various Unix-like operating systems is susceptible to an information disclosure vulnerability. The service returns distinct error messages when a remote user attempts to mount a path, differentiating between paths that do not exist and paths that exist but are not exported or accessible. A remote, unauthenticated attacker can exploit this behavior to conduct file enumeration across the server's filesystem. This is a side-channel attack via error message analysis that requires network access to the RPC mount service.

Affected products

Linux Foundation Linux
Digital Equipment Corporation (DEC) Ultrix

Timeline

1997-08-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.