Quick answers
- Is CVE-1999-1311 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-1311 being exploited in the wild.
- How severe is CVE-1999-1311?
- Medium severity, with a CVSS score of 4.6, published 7 January 1997.
- Which products and versions are affected?
- Hp-Ux 10.10, 10.20.
- Is there a fix for CVE-1999-1311?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-1311 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-1311?
- Check whether you run Hp-Ux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists within the Common Desktop Environment (CDE) components dtlogin and dtsession on HP-UX versions 10.10 and 10.20. The flaw allows a local attacker to bypass the standard authentication mechanism, potentially leading to unauthorized privilege escalation. Because the attack vector is local, the attacker must already have access to a local shell or physical console. Successful exploitation grants the attacker the ability to execute commands with the permissions of other users or the system itself. While specific technical root causes like buffer overflows or logic errors are not detailed in the legacy advisory, the impact is a confirmed authentication bypass.
Affected products
- HP HP-UX 10.10, 10.20
Timeline
- 1997-01-07: disclosed: Initial publication date