# CVE-1999-1449: Sun Microsystems SunOS kernel panic via /dev/tcx0 read

Source: https://junglewise.ai/threats/cve-1999-1449-sun-microsystems-sunos-kernel-panic-via-dev-tcx0-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-05-19. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1449 · Severity: low · CVSS 2.1 · Published 1997-05-19

A vulnerability in the SunOS operating system running on Sparc 20 hardware allows any user with local access to crash the entire system. By attempting to read from a specific graphics device file, a user can trigger a kernel panic, leading to a total service outage. This can be used to disrupt operations or facilitate other attacks by taking the machine offline.

Technologies: [Sunos](https://junglewise.ai/threats/technologies/sunos). Vendors: [Sun](https://junglewise.ai/threats/vendors/sun).

## Quick answers

**Is CVE-1999-1449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1449 being exploited in the wild.

**How severe is CVE-1999-1449?** Low severity, with a CVSS score of 2.1, published 19 May 1997.

**Which products and versions are affected?** Sun Microsystems SunOS 4.1.4.

**Is there a fix for CVE-1999-1449?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1449 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1449?** Check whether you run Sunos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in SunOS 4.1.4 on Sparc 20 architectures due to improper handling of read operations on the /dev/tcx0 TCX frame buffer device. A local, unprivileged attacker can trigger a kernel panic by executing simple read commands (e.g., 'cat' or 'ls') against the device node. The root cause appears to be a failure in the device driver to handle unexpected access patterns on systems where the TCX hardware may not be present or properly initialized. A suggested workaround is the removal of the /dev/tcx0 device node if the hardware is not in use.

## Affected products

- Sun Microsystems SunOS 4.1.4

## Timeline

- 1997-05-19: disclosed: Initial disclosure on Bugtraq mailing list.
- 1997-05-19: advisory: NVD published date.

## References

- [http://oamk.fi/~jukkao/bugtraq/before-971202/0498.html](http://oamk.fi/~jukkao/bugtraq/before-971202/0498.html)
- [http://www.insecure.org/sploits/sunos.dev.tcx0.write.wierd.shit.to.device.bug.html](http://www.insecure.org/sploits/sunos.dev.tcx0.write.wierd.shit.to.device.bug.html)

## Related threats

- [Sun NIS+ authentication bypass in rpc.nisd](https://junglewise.ai/threats/cve-1999-0795-sun-nis-authentication-bypass-in-rpc-nisd)
- [Sun Solaris arbitrary file read in volrmmount](https://junglewise.ai/threats/cve-1999-0296-sun-solaris-arbitrary-file-read-in-volrmmount)
- [Sun Solaris Telnet denial of service via control characters](https://junglewise.ai/threats/cve-1999-0273-sun-solaris-telnet-denial-of-service-via-control-characters)
- [Sun Solaris buffer overflow in libc getopt function](https://junglewise.ai/threats/cve-1999-0966-sun-solaris-buffer-overflow-in-libc-getopt-function)
- [Sun WorkMan arbitrary file overwrite and privilege escalation](https://junglewise.ai/threats/cve-1999-0277-sun-workman-arbitrary-file-overwrite-and-privilege-escalation)