# CVE-1999-1391: NeXT NeXTSTEP privilege escalation in npd

Source: https://junglewise.ai/threats/cve-1999-1391-next-nextstep-privilege-escalation-in-npd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1990-10-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1391 · Severity: high · CVSS 7.2 · Published 1990-10-03

A security vulnerability in early NeXT operating systems allows a person with physical or local access to the computer to gain full administrative control. By exploiting the printer management software and poorly secured system folders, an unauthorized user can bypass security restrictions to access or delete any data on the machine. This could lead to a total compromise of the system's confidentiality and integrity.

Technologies: [Nextstep](https://junglewise.ai/threats/technologies/nextstep). Vendors: [Next](https://junglewise.ai/threats/vendors/next).

## Quick answers

**Is CVE-1999-1391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1391 being exploited in the wild.

**How severe is CVE-1999-1391?** High severity, with a CVSS score of 7.2, published 3 October 1990.

**Which products and versions are affected?** Nextstep 1.0, 1.0a.

**Is there a fix for CVE-1999-1391?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1391 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1391?** Check whether you run Nextstep at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in NeXT 1.0 and 1.0a due to a combination of the npd (NeXT Printer Daemon) program and insecure directory permissions. The vulnerability allows a local attacker to manipulate system files or execution paths to escalate their privileges to root. The attack vector is local, requiring the attacker to have an account or access to the local system. Successful exploitation results in complete compromise of the system (Confidentiality, Integrity, and Availability). Patch information is historically referenced in CERT advisory CA-1990-06.

## Affected products

- NeXT NeXTSTEP 1.0, 1.0a

## Timeline

- 1990-10-03: advisory: NVD published date
- 1990-10-03: disclosed: Initial disclosure via CERT CA-1990-06

## References

- [http://ciac.llnl.gov/ciac/bulletins/b-01.shtml](http://ciac.llnl.gov/ciac/bulletins/b-01.shtml)
- [http://www.cert.org/advisories/CA-1990-06.html](http://www.cert.org/advisories/CA-1990-06.html)
- [http://www.iss.net/security_center/static/7143.php](http://www.iss.net/security_center/static/7143.php)
- [http://www.securityfocus.com/bid/10](http://www.securityfocus.com/bid/10)

## Related threats

- [NeXT NeXTstep privilege escalation via me user in wheel group](https://junglewise.ai/threats/cve-1999-1193-next-nextstep-privilege-escalation-via-me-user-in-wheel-group)
- [NeXT NeXTSTEP privilege escalation in restore0.9 installation script](https://junglewise.ai/threats/cve-1999-1392-next-nextstep-privilege-escalation-in-restore0-9-installation)
- [NeXT NeXTSTEP privilege escalation in BuildDisk](https://junglewise.ai/threats/cve-1999-1198-next-nextstep-privilege-escalation-in-builddisk)