Is CVE-1999-1489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1489 being exploited in the wild.

How severe is CVE-1999-1489?

High severity, with a CVSS score of 7.2, published 4 March 1997.

Which products and versions are affected?

Slackware Slackware Linux 3.1; XFree86 Project XFree86 SuperProbe.

Is there a fix for CVE-1999-1489?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1489 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1489?

Check whether you run Slackware Linux or Xfree86 Project SuperProbe. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1489: XFree86 SuperProbe buffer overflow in TestChip function

CVE-1999-1489 · Severity: high · CVSS 7.2 · Published 1997-03-04

A security vulnerability exists in the SuperProbe utility, a tool used in older Linux distributions to identify video hardware. A local user can exploit this flaw to bypass security restrictions and gain full administrative (root) control over the system. This could lead to a complete compromise of the machine, including unauthorized access to all data and system settings.

Technologies: Slackware Linux. Vendors: Slackware.

Quick answers

Is CVE-1999-1489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1489 being exploited in the wild.
How severe is CVE-1999-1489?: High severity, with a CVSS score of 7.2, published 4 March 1997.
Which products and versions are affected?: Slackware Slackware Linux 3.1; XFree86 Project XFree86 SuperProbe.
Is there a fix for CVE-1999-1489?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1489 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1489?: Check whether you run Slackware Linux or Xfree86 Project SuperProbe. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic stack-based buffer overflow exists within the TestChip function of the XFree86 SuperProbe utility. The vulnerability is triggered when the application processes an excessively long string provided via the '-nopr' command-line argument. Because SuperProbe was often installed with setuid root permissions to allow direct hardware access, an unprivileged local attacker can exploit this overflow to overwrite the instruction pointer and execute arbitrary code with elevated privileges. This results in a full local privilege escalation to root. Patch information is referenced in historical security archives, typically involving bounds checking on command-line inputs.

Affected products

Slackware Slackware Linux 3.1
XFree86 Project XFree86 SuperProbe

Timeline

1997-03-04: disclosed
1997-03-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.