Is CVE-1999-1269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1269 being exploited in the wild.

How severe is CVE-1999-1269?

Low severity, with a CVSS score of 2.1, published 6 February 1998.

Which products and versions are affected?

KDE KDE Desktop Environment Beta 3.

Is there a fix for CVE-1999-1269?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1269 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1269?

Check whether you run Kde Beta 3 or Kde Plasma Desktop. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1269: KDE Beta 3 arbitrary file overwrite via symlink in screen saver

CVE-1999-1269 · Severity: low · CVSS 2.1 · Published 1998-02-06

A vulnerability in the KDE desktop environment's screen saver component allows a local user to overwrite system files. By creating a malicious symbolic link, an attacker can trick the system into writing data to a file it shouldn't access. This could lead to system instability or the corruption of important configuration files.

Vendors: Kde.

Quick answers

Is CVE-1999-1269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1269 being exploited in the wild.
How severe is CVE-1999-1269?: Low severity, with a CVSS score of 2.1, published 6 February 1998.
Which products and versions are affected?: KDE KDE Desktop Environment Beta 3.
Is there a fix for CVE-1999-1269?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1269 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1269?: Check whether you run Kde Beta 3 or Kde Plasma Desktop. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a symlink race condition/attack involving the '.kss.pid' file used by KDE screen savers. A local attacker can create a symbolic link from the expected location of the PID file to an arbitrary target file on the system. When the screen saver process attempts to write its process ID to '.kss.pid', it follows the symlink and overwrites the target file with its PID. This requires local access to the machine and can result in unauthorized modification of files, potentially leading to a denial of service or further system compromise depending on the file overwritten.

Affected products

KDE KDE Desktop Environment Beta 3

Timeline

1998-02-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.