# CVE-1999-1311: HP HP-UX authentication bypass in dtlogin and dtsession

Source: https://junglewise.ai/threats/cve-1999-1311-hp-hp-ux-authentication-bypass-in-dtlogin-and-dtsession  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-01-07. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1311 · Severity: medium · CVSS 4.6 · Published 1997-01-07

A security flaw in the login and session management components of HP-UX allows local users to bypass standard authentication procedures. This could allow an unauthorized person with physical or terminal access to the system to gain elevated administrative privileges. Such an exploit compromises the integrity of the operating system and the security of all data stored on the affected machine.

Technologies: [Hp-Ux](https://junglewise.ai/threats/technologies/hp-ux). Vendors: [Hp](https://junglewise.ai/threats/vendors/hp).

## Quick answers

**Is CVE-1999-1311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1311 being exploited in the wild.

**How severe is CVE-1999-1311?** Medium severity, with a CVSS score of 4.6, published 7 January 1997.

**Which products and versions are affected?** Hp-Ux 10.10, 10.20.

**Is there a fix for CVE-1999-1311?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1311 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1311?** Check whether you run Hp-Ux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists within the Common Desktop Environment (CDE) components dtlogin and dtsession on HP-UX versions 10.10 and 10.20. The flaw allows a local attacker to bypass the standard authentication mechanism, potentially leading to unauthorized privilege escalation. Because the attack vector is local, the attacker must already have access to a local shell or physical console. Successful exploitation grants the attacker the ability to execute commands with the permissions of other users or the system itself. While specific technical root causes like buffer overflows or logic errors are not detailed in the legacy advisory, the impact is a confirmed authentication bypass.

## Affected products

- HP HP-UX 10.10, 10.20

## Timeline

- 1997-01-07: disclosed: Initial publication date

## References

- [http://ciac.llnl.gov/ciac/bulletins/h-21.shtml](http://ciac.llnl.gov/ciac/bulletins/h-21.shtml)

## Related threats

- [IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands…](https://junglewise.ai/threats/cve-2026-13476-ibm-informix-dynamic-server-14-10-15-0-and-12-10-could-allow-an)
- [IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.](https://junglewise.ai/threats/cve-2026-13367-ibm-informix-dynamic-server-14-10-and-15-0-contain-a-local)
- [Multiple Vendors TCP/IP Land denial of service](https://junglewise.ai/threats/cve-1999-0016-multiple-vendors-tcp-ip-land-denial-of-service)
- [Sun Solaris automountd command injection via shell metacharacters](https://junglewise.ai/threats/cve-1999-0210-sun-solaris-automountd-command-injection-via-shell-metacharacters)
- [Linux inetd denial of service via SYN and RST packets](https://junglewise.ai/threats/cve-1999-0216-linux-inetd-denial-of-service-via-syn-and-rst-packets)