# CVE-1999-1468: UNIX rdist privilege escalation via IFS variable manipulation

Source: https://junglewise.ai/threats/cve-1999-1468-unix-rdist-privilege-escalation-via-ifs-variable-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1991-10-22. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1468 · Severity: medium · CVSS 6.2 · Published 1991-10-22

A vulnerability in the 'rdist' utility, a tool used on older UNIX systems to maintain identical copies of files across multiple hosts, could allow a local user to gain full administrative (root) control of the system. By manipulating how the system interprets command separators, an attacker can trick the utility into executing unauthorized programs with elevated privileges. This poses a significant risk to the integrity and confidentiality of the affected server.

## Quick answers

**Is CVE-1999-1468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1468 being exploited in the wild.

**How severe is CVE-1999-1468?** Medium severity, with a CVSS score of 6.2, published 22 October 1991.

**Which products and versions are affected?** various UNIX.

**Is there a fix for CVE-1999-1468?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1468 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1468?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'rdist' utility in various UNIX distributions is vulnerable to a privilege escalation attack. The vulnerability exists because rdist uses the popen() function to execute sendmail for mailing status reports. Because popen() invokes the shell (/bin/sh) to execute the command, it is susceptible to IFS (Internal Field Separator) manipulation. A local attacker can modify the IFS environment variable to include a slash ('/') or other characters, causing the shell to misinterpret the path to sendmail and instead execute an arbitrary program with the root privileges of the setuid rdist binary. This is a classic shell metacharacter/environment manipulation vulnerability. Patching typically involves replacing popen() with safer alternatives like execve() or ensuring the environment is sanitized before execution.

## Affected products

- various UNIX

## Timeline

- 1991-10-22: disclosed
- 1991-10-22: advisory

## References

- [http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-01.html](http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-01.html)
- [http://www.cert.org/advisories/CA-91.20.rdist.vulnerability](http://www.cert.org/advisories/CA-91.20.rdist.vulnerability)
- [http://www.iss.net/security_center/static/7160.php](http://www.iss.net/security_center/static/7160.php)
- [http://www.osvdb.org/8106](http://www.osvdb.org/8106)
- [http://www.securityfocus.com/bid/31](http://www.securityfocus.com/bid/31)