Quick answers
- Is CVE-1999-1272 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-1272 being exploited in the wild.
- How severe is CVE-1999-1272?
- High severity, with a CVSS score of 7.2, published 1 March 1998.
- Which products and versions are affected?
- Sgi Irix All versions prior to March 1998 advisory.
- Is there a fix for CVE-1999-1272?
- A patch was published on 1998-03-01: SGI released patches for affected systems Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-1999-1272 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-1272?
- Check whether you run Sgi Irix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The CDROM Confidence Test program (cdrom) contains multiple buffer overflow vulnerabilities. Because this diagnostic utility often runs with elevated privileges to interact directly with hardware, a local attacker can provide specially crafted input to overflow internal buffers and execute arbitrary code. Successful exploitation allows a non-privileged local user to escalate their privileges to root. The vulnerability was originally identified in SGI IRIX systems, and patches were released by the vendor in early 1998.
Affected products
- SGI IRIX All versions prior to March 1998 advisory
Timeline
- 1998-03-01: disclosed: Initial security advisory released by SGI
- 1998-03-01: patched: SGI released patches for affected systems