# CVE-1999-1272: SGI IRIX buffer overflow in CDROM Confidence Test program

Source: https://junglewise.ai/threats/cve-1999-1272-sgi-irix-buffer-overflow-in-cdrom-confidence-test-program  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1998-03-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1272 · Severity: high · CVSS 7.2 · Published 1998-03-01

A security vulnerability exists in the CDROM Confidence Test utility, a diagnostic tool used to verify the functionality of CD-ROM drives. A local user with access to the system can exploit this flaw to bypass security restrictions and gain full administrative (root) control. This could lead to a complete compromise of the system, including unauthorized access to all data and the ability to modify or delete critical system files.

Technologies: [Sgi Irix](https://junglewise.ai/threats/technologies/irix). Vendors: [Sgi](https://junglewise.ai/threats/vendors/sgi).

## Quick answers

**Is CVE-1999-1272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1272 being exploited in the wild.

**How severe is CVE-1999-1272?** High severity, with a CVSS score of 7.2, published 1 March 1998.

**Which products and versions are affected?** Sgi Irix All versions prior to March 1998 advisory.

**Is there a fix for CVE-1999-1272?** A patch was published on 1998-03-01: SGI released patches for affected systems Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-1999-1272 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1272?** Check whether you run Sgi Irix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CDROM Confidence Test program (cdrom) contains multiple buffer overflow vulnerabilities. Because this diagnostic utility often runs with elevated privileges to interact directly with hardware, a local attacker can provide specially crafted input to overflow internal buffers and execute arbitrary code. Successful exploitation allows a non-privileged local user to escalate their privileges to root. The vulnerability was originally identified in SGI IRIX systems, and patches were released by the vendor in early 1998.

## Affected products

- SGI IRIX All versions prior to March 1998 advisory

## Timeline

- 1998-03-01: disclosed: Initial security advisory released by SGI
- 1998-03-01: patched: SGI released patches for affected systems

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/1635](https://exchange.xforce.ibmcloud.com/vulnerabilities/1635)

## Related threats

- [Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned…](https://junglewise.ai/threats/cve-1999-1492-vulnerability-in-1-diskperf-and-2-diskalign-in-irix-6-4-allows)
- [Vulnerability in (1) diskalign and (2) diskperf in IRIX 6.4 patches 2291 and 2848 allow a local user to create…](https://junglewise.ai/threats/cve-1999-1039-vulnerability-in-1-diskalign-and-2-diskperf-in-irix-6-4-patches)
- [SGI IRIX buffer overflow in xterm and Xaw](https://junglewise.ai/threats/cve-1999-0126-sgi-irix-buffer-overflow-in-xterm-and-xaw)
- [SGI IRIX buffer overflow in printers program](https://junglewise.ai/threats/cve-1999-0108-sgi-irix-buffer-overflow-in-printers-program)
- [SGI IRIX command injection in ipxchk and ipxlink](https://junglewise.ai/threats/cve-1999-1501-sgi-irix-command-injection-in-ipxchk-and-ipxlink)