# CVE-1999-1491: Red Hat Linux abuse.console privilege escalation via relative pathnames

Source: https://junglewise.ai/threats/cve-1999-1491-red-hat-linux-abuse-console-privilege-escalation-via-relative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-02-02. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1491 · Severity: high · CVSS 7.2 · Published 1996-02-02

A vulnerability in the 'abuse' game console on Red Hat Linux 2.1 allows local users to gain full administrative control of the system. The software incorrectly looks for a helper program using a relative file path instead of a secure, fixed location. An attacker can trick the system into running a malicious program with root privileges, leading to a complete system takeover.

Technologies: [Redhat Linux](https://junglewise.ai/threats/technologies/linux). Vendors: [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-1999-1491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1491 being exploited in the wild.

**How severe is CVE-1999-1491?** High severity, with a CVSS score of 7.2, published 2 February 1996.

**Which products and versions are affected?** Red Hat Linux 2.1 (Red Hat) 2.1.

**Is there a fix for CVE-1999-1491?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1491 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1491?** Check whether you run Redhat Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'abuse.console' binary in Red Hat 2.1 is installed with the setuid root bit enabled. It attempts to execute a helper program named 'undrv' using a relative pathname rather than an absolute one. Because the program assumes it is being run from its own installation directory, a local attacker can execute 'abuse.console' from a directory they control (such as /tmp) containing a malicious 'undrv' executable. Since 'abuse.console' runs with root privileges, the substituted malicious program is also executed as root, allowing for local privilege escalation. The recommended mitigation is to remove the setuid bit from the affected binary.

## Affected products

- Red Hat Linux 2.1 (Red Hat) 2.1

## Timeline

- 1996-02-02: disclosed: Initial disclosure on Bugtraq by David J Meltzer
- 1996-02-02: advisory: NVD publication date

## References

- [http://marc.info/?l=bugtraq&m=87602167418994&w=2](http://marc.info/?l=bugtraq&m=87602167418994&w=2)
- [http://www.securityfocus.com/bid/354](http://www.securityfocus.com/bid/354)

## Related threats

- [xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable.](https://junglewise.ai/threats/cve-1999-1490-xosview-1-5-1-in-red-hat-5-1-allows-local-users-to-gain-root)
- [Red Hat Linux 5 symlink attack in ifdhcpc-done script](https://junglewise.ai/threats/cve-1999-1407-red-hat-linux-5-symlink-attack-in-ifdhcpc-done-script)
- [Multiple Linux Distributions sort utility symlink vulnerability in /tmp](https://junglewise.ai/threats/cve-1999-1095-multiple-linux-distributions-sort-utility-symlink-vulnerability-in)
- [Bellcore metamail arbitrary command execution via message headers](https://junglewise.ai/threats/cve-1999-0037-bellcore-metamail-arbitrary-command-execution-via-message-headers)
- [Linux rcp arbitrary file overwrite via UID 65535 integer signedness error](https://junglewise.ai/threats/cve-1999-1299-linux-rcp-arbitrary-file-overwrite-via-uid-65535-integer)