# CVE-1999-1266: rshd user enumeration via differential error messages

Source: https://junglewise.ai/threats/cve-1999-1266-rshd-user-enumeration-via-differential-error-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-06-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1266 · Severity: medium · CVSS 5 · Published 1997-06-13

The remote shell daemon (rshd), a service used for executing commands on remote computers, contains a flaw in how it handles login errors. By observing the specific error messages returned during a connection attempt, an attacker can distinguish between valid and invalid usernames. This allows an attacker to build a list of real user accounts on the system, which can be used to facilitate more targeted password-guessing or social engineering attacks.

Technologies: [Metamail Corporation Metamail](https://junglewise.ai/threats/technologies/metamail). Vendors: [Metamail Corporation](https://junglewise.ai/threats/vendors/metamail-corporation).

## Quick answers

**Is CVE-1999-1266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1266 being exploited in the wild.

**How severe is CVE-1999-1266?** Medium severity, with a CVSS score of 5, published 13 June 1997.

**Which products and versions are affected?** unknown rshd (rsh daemon).

**Is there a fix for CVE-1999-1266?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1266 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-1266?** Check whether you run Metamail Corporation Metamail or Rshd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rsh daemon (rshd) is vulnerable to information disclosure via an observable response discrepancy (user enumeration). When a remote user attempts to connect, the daemon returns distinct error messages depending on whether the provided username exists on the local system. This is a network-based attack that requires no prior authentication. An attacker can automate requests to the service to brute-force or 'harvest' valid account names, significantly reducing the effort required for subsequent credential-based attacks. This behavior is inherent to older implementations of the rsh protocol.

## Affected products

- unknown rshd (rsh daemon)

## Timeline

- 1997-06-13: disclosed

## References

- [http://www.securityfocus.com/archive/1/6978](http://www.securityfocus.com/archive/1/6978)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/1660](https://exchange.xforce.ibmcloud.com/vulnerabilities/1660)

## Related threats

- [Red Storm Rainbow Six buffer overflow in Multiplayer nick command](https://junglewise.ai/threats/cve-1999-1261-red-storm-rainbow-six-buffer-overflow-in-multiplayer-nick-command)