Quick answers
- Is CVE-1999-1498 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-1498 being exploited in the wild.
- How severe is CVE-1999-1498?
- Low severity, with a CVSS score of 3.6, published 6 April 1998.
- Which products and versions are affected?
- Slackware Slackware Linux 3.4.
- Is there a fix for CVE-1999-1498?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-1498 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-1498?
- Check whether you run Slackware Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The pkgtool utility in Slackware Linux 3.4 is vulnerable to a symbolic link (symlink) race condition. The application creates a temporary 'reply' file in a predictable or insecure manner, allowing a local attacker to create a symlink at that location pointing to an arbitrary file on the system. When pkgtool operates on this file with elevated privileges, it follows the symlink, enabling the attacker to read from or write to sensitive files (such as system configuration or password files) that are otherwise restricted. This is a classic insecure temporary file vulnerability.
Affected products
- Slackware Slackware Linux 3.4
Timeline
- 1998-04-06: disclosed: Initial publication date